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DISCLAIMER 


I  IT  Research  Institute  (IITRI)  has  exercised  its*  best  efforts  in  performing 
the  hazards  analysis  presented  in  this  report,  within  the  scope  of  work  of  the 
program.  However,  IITRI  specifically  disclaims  any  warranty  or  implication  that 
hazards  or  accidents  will  be  completely  eliminated  or  that  any  criteria  of  hazard 
elimination  will  be  achieved  if  the  recommendations  presented  in  this  report  are 
adopted.  The  analyses  were  based  on  the  design,  operating  procedures,  and  pro¬ 
cess  material  defined  at  the  time  of  the  analysis  or  as  presented  to  IITRI  per¬ 
sonnel.  Therefore,  the  conclusions  of  the  hazards  analysis  may  be  invalidated 
if  there  are  any  changes  to  these  conditions  in  the  future. 
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FOREWORD 

This  is  the  final  report  on  Contract  No.  DAAA09-81-C-3006  conducted  by 
I IT  Research  Institute,  Chicago,  Illinois,  for  the  U.S.  Army  ARRCOM ,  Rock 
Island,  Illinois.  This  report  describes  the  results  of  a  hazards  analysis  of 
the  Western  Area  Demilitarization  Facility  (WADF)  at  Hawthorne,  Nevada.  The 
project  was  divided  into  three  segments  (priorities)  and  detailed  reports  have 
been  submitted  describing  the  analyses  and  results  for  each  priority.  The 
Priority  1  Report,  covering  the  Steam  and  Hydraulic  Systems,  was  submitted 
during  July  1982.  The  Priority  2  Report,  covering  the  Preparation  Building, 
the  Accumulator,  the  Mechanical  Removal  Building,  and  the  Large  Cells,  was 
submitted  during  November  1982.  The  Priority  3  Report,  covering  the  Decontamina¬ 
tion  Building,  the  Large  Items  Flashing  Chamber,  the  Driverless  Tractor  System, 
the  Offloading  Dock,  and  the  Magazines,  was  submitted  during  December  1982 
concurrent  to  this  report. 

Members  of  the  IIT  Research  Institute  staff  who  contributed  significantly 
to  this  project  include  Dwayne  Eacret,  Charles  Heilker,  Cindy  Marrazzo,  Kim 
Mniszewski ,  Ronald  Pape,  and  Edmund  Swider.  Mr.  Thomas  Grady,  a  private  con¬ 
sultant  with  considerable  experience  in  explosive  and  propellant  operations, 
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suggestions. 
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1 .  INTRODUCTION 


In  this  report,  the  results  of  a  hazards  analysis  of  the  Western  Area 
Demilitarization  Facility  (WADF)  at  Hawthorne,  Nevada  are  summarized.  The 
details  of  the  analyses  are  provided  in  three  reports  (references  1,  2  and  3) 
and  are  not  repeated  in  this  document.  Each  of  the  detailed  reports  consists 
of  two  volumes.  Volume  1  is  a  summary  of  the  analysis  results  with  appendices 
covering  special  problem  areas.  Volume  2  contains  fault  tree  diagrams  for 
each  of  the  plant  areas  that  were  evaluated.  This  final  report  contains  an 
overview  of  the  WADF  systems  (Section  2),  the  hazards  analysis  methodology 
that  was  applied  (Section  3),  a  discussion  of  the  quantitative  fault  tree 
results  in  terms  of  the  95  percent  confidence  level  (Section  4),  and  a  compila 
tion  of  the  conclusions  and  recommendations  for  each  area  of  the  facility 
(Section  5).  The  recommendations  have  been  prioritized  in  section  6  (refer 
to  Table  2  on  pages  50-54).  Recommendations  with  rankings  of  6  to  10  are 
considered  to  be  crucial  and  should  be  implemented,  or  at  a  minimum  critically 
evaluated. 
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2.  OVERVIEW  OF  THE  WESTERN  AREA  DEMILITARIZATION  FACILITY 


The  Western  Area  Demilitarization  Facility  (WADF)  was  designed  "to  demili¬ 
tarize  obsolete,  out-of-date,  or  unserviceable  conventional  ammunition  items 
by  safe,  economical,  and  environmentally  acceptable  techniques"  (ref.  4).  The 
volume  of  such  material  that  should  be  disposed  of  is  increasing  significantly 
and  must  be  dealt  with.  Costs  associated  with  storage  (space,  record  keeping, 
and  security)  are  increasing.  Existing  facilities  are  not  easily  adapted  to 
handle  the  required  production  rates. 

The  facility  at  Hawthorne,  Nevada  was  initially  designed  under  the  Naval 
Facilities  Engineering  Command,  Western  Division,  and  has  since  been  trans¬ 
ferred  to  Army  responsibility. 

The  WADF  system  consists  of  the  Off-Loading  Dock,  Driverless  Tractor, 
Preparation  Building,  Accumulator  Building,  Mechanical  Removal  Building, 

Large  Cells,  Washout/Steamout  Building,  Process  Water  Treatment  Facility, 

Bulk  Explosives  Disposal  Building,  Refining  Building,  Flashing  Chamber,  and 
the  Decontamination  and  Small  Items  Building.  These  were  evaluated  for  hazards 
under  three  priorities.  Priority  1  included  the  "wet  systems"  (Washout 
Steamout  Building,  Refining  Building,  Bulk  Explosives  Disposal  Building,  and 
the  Process  Water  Treatment  Plant).  Priority  2  included  the  Preparation 
Building,  the  Mechanical  Removal  Building  and  the  Large  Cells.  Priority  3 
contained  the  Decontamination  Building,  the  Large  Items  Flashing  Chamber,  the 
Driverless  Tractor  System,  the  Off-Loading  Dock,  and  the  Magazines.  These  systems 
are  described  in  the  paragraphs  below. 

2.1  PRIORITY  1  SYSTEMS 
Washout/Steamout  Building 

The  Washout/Steamout  Building  consists  of  two  towers  separated  by  a 
support  area  containing  a  boiler  room,  steam  room,  and  chemical  laboratories.  This 
facility  is  for  wet  removal  of  explosives  (i.e.,  by  steam  and  hydraulic  processes). 
There  are  four  categories  of  wet  processes.  First,  for  TNT  or  similar  single 
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phase  meltable  explosives,  the  material  is  melted  by  contact  with  a  steam  jet. 

It  is  drained  from  the  item,  de-watered,  formed  into  dry  flakes  and  packaged. 
This  procedure  is  accomplished  in  the  Steamout  Building— North  Tower.  Second, 
for  explosive  D  or  other  similar  relatively  soluble  explosives,  hot  low 
pressure  water  is  used  to  hydraulically  wash  out  the  material  (by  erosion  and 
solution).  The  material  is  directed  into  a  large  transportable  container  for 
subsequent  disposal  at  the  Explosives  Disposal  Building.  This  operation  is 
accomplished  in  the  Washout  Building— South  Tower.  For  Composition  A3  or 
similar  press  loaded  explosives,  a  very  high  pressure  (10,000  psi)  water  jet 
is  used  to  break  up  the  material  by  erosive  action.  The  material  is  flushed 
out  of  the  item,  de-watered,  and  packaged.  This  operation  is  also  accomplished 
in  the  South  Tower. 

The  Washout  Building  (South  Tower)  holds  two  washout  chambers  at  the  top 
levels  of  the  tower.  The  large  items  washout  chamber  is  for  8  inch  and  16 
inch  projectiles  only.  This  chamber  uses  a  lower  pressure  hot  water  lance 
to  erode  and  dissolve  out  explosive  D  or  similar  materials  from  items.  The 
medium  caliber  indexing  table  handles  smaller  munitions  items  (containing 
explosive  D  or  A3)  two  at  a  time.  High  pressure  (10,000  psi)  water  lances  are 
used  to  erode  out  the  material  in  two  steps.  Explosive  D  from  either  washout 
device  is  dropped  into  a  settling  tank  and  ultimately  loaded  into  movable  tanks 
for  transport  to  the  Explosives  Disposal  Building.  Explosive  A3  is  loaded  onto 
a  vibrating  screen  dryer  to  remove  the  majority  of  the  water.  It  then  is  passed 
through  a  belt  air  dryer  prior  to  packaging. 

In  the  North  Tower  large  items  containing  TNT  and  HBX  (possibly  Tritonal 
and  H6  also  eventually)  are  handled.  Currently,  this  includes  items  such  as 
Ml 6,  M25  and  M39  mines,  but  may  also  include  bombs  eventually.  The  items 
are  hoisted  to  the  top  level  of  the  tower  and  strapped  onto  tilting  tables. 

The  tables  are  put  in  a  45°  incline  so  that  the  operator  on  the  next  level 
down  can  insert  a  lance  into  each  item.  As  the  material  is  drained  out  of 
the  item,  the  operator  manually  advances  the  lance.  The  operation  can  take 
up  to  8  hours  to  complete.  After  steamout  is  complete,  the  tables  are  brought 
back  to  horizontal  position,  the  item  is  then  hoisted  up  and  put  into  one  of 
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four  autoclaves  to  melt  out  the  asphalt  liner  and  any  residual  explosive.  The 
explosive  removed  from  the  items  flows  into  a  storage  kettle.  From  there  it 
goes  to  a  steam  jacketed  kettle  for  metering  onto  a  belt  flaker.  The  melted 
asphalt  and  residual  explosive  flows  to  a  kernelling  machine  where  the  con¬ 
taminated  asphalt  is  solidified  into  globules  for  disposal. 

Mater  Treatment  Facility 

The  Process  Water  Treatment  Facility  sits  adjacent  to  the  Washout/Steamout 
Building.  This  is  a  fairly  conventional  system  for  water  treatment.  Feed  is 
added  to  the  clarifier  with  alum  and  polymer.  The  alum  coagulates  substances 
in  the  water.  The  polymer  aids  coagulation.  The  coagulation-flocculation 
begins  with  a  rapid  mix  in  the  top  and  gentler  mixing  in  the  mid  region.  The 
agglomerated  particles  settle  to  the  bottom  and  are  removed  with  positive 
displacement  pumps.  The  sludge  from  the  bottom  is  only  about  5  percent  solids 
and  is  dewatered  further  in  the  sludge  basins.  The  clarified  water  is  then 
filtered.  The  effluent  turbidity  is  monitored  (from  sand  filters)  and  back- 
washing  of  the  filters  is  initiated  when  the  turbidity  is  too  high.  The  sand 
filters  remove  any  floe  particles  which  have  not  settled  from  the  chemical 
precipitation.  The  activiated  carbon  columns  remove  organics.  When  the  pres¬ 
sure  gradient  through  the  carbon  columns  becomes  too  high,  either  the  media 
will  be  replaced  or  backwashing  will  be  done.  The  pH  of  the  water  can  be 
from  9  to  11 ;  therefore,  H2SO4  is  added  and  mixed  with  an  in-line  static 
mixer.  The  final  pH  should  be  in  the  range  from  6-8. 

Refining  Building 

The  Refining  Building  is  to  be  used  for  removal  of  melt-cast  explosives 
from  projectiles  (small  items,  up  to  7.2  in.  depth  charges).  The  exterior  of 
the  shell  is  exposed  to  pressurized  superheated  steam  (dry  thermal  process 
from  the  standpoint  of  the  explosive).  The  items  are  positioned  into  a  hold¬ 
ing  fixture  designed  to  prevent  the  steam  from  entering  the  item  and  contact¬ 
ing  the  explosive  inside.  The  items  are  then  hoisted  up  and  lowered  into  one 
of  the  autoclaves  in  the  Refining  Building.  As  the  explosive  melts,  it  is 
drained  through  the  bottom  of  the  autoclave  unit  into  a  steam  jacketed  holding 
tank.  The  liquid  explosive  is  then  fed  into  strands  onto  a  stainless  steel 
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belt  flaker.  It  cools  and  solidifies  on  the  belt  and  is  broken  up  into  flakes 
at  the  exit  end  of  the  unit.  The  flaker  unit  is  hooded  to  remove  fumes  and 
is  protected  by  UV  detectors  used  to  trigger  a  water  deluge.  The  flakes  are 
metered  by  vibratory  conveyor  into  a  weigh  unit  and  packaged  for  shipment  or 
storage. 

Bulk  Explosives  Disposal  Building 

Non-saleable  energetic  materials,  such  as  explosive  D  and  those  double  and 
triple  base  propellants  that  cannot  be  sold,  are  handled  at  the  Bulk  Explosives 

Disposal  Building.  Containers  holding  the  material  are  conveyed  into  the  slurry 
preparation  area.  The  container  contents  are  dumped  into  the  feed  hopper  for 
the  grinder.  The  feeder  conveyer  passes  the  material  through  a  metal  detector 
prior  to  discharge  into  the  grinder.  In  the  grinder,  the  material  is  ground, 
with  water  injection,  into  small  pieces,  and  passed  into  the  slurry  tank.  A 
slurry  consisting  of  a  3:1  mixture  of  water  to  solids  by  mass  (monitored  by 
slurry  density)  is  prepared  in  the  slurry  tank  and  then  transferred  to  the 
adjacent  cell  of  the  building.  The  slurry  is  circulated  in  a  loop  at  about 
25  gpm  between  the  feed  tank  and  one  of  the  two  incinerator  units  outside  of 
the  building.  It  is  bled  off  from  the  loop  at  about  7  gpm  and  injected  into 
the  oil  fired  rotating  drum  incineration  unit.  The  primary  incinerator  sec¬ 
tion  is  a  drum  furnace  rotating  at  3  rpm.  The  combustion  products  then  pass 
through  an  afterburner  and  exhaust  stack. 

2.2  PRIORITY  2  SYSTEMS 
Preparation  Building  and  Accumulator 

Mechanical  disassembly  of  items  is  to  be  performed  in  the  Preparation 
Building  in  individual  cell  areas  of  the  building.  Processes  include  (1)  pull 
apart  of  elements  joined  by  crimping  (e.g.,  removing  the  projectile  from  the 
cartridge  case);  (2)  unscrewing  the  parts  such  as  fuzes  from  projectiles, 
rocket  motors  from  warheads,  or  fuzes  and  fin  assemblies  from  mortar  cartridges; 
(3)  removal  of  propellant  from  cartridges;  and  (4)  removal  of  primers  from  cart¬ 
ridge  cases.  The  Preparation  Building  cells  are  to  handle  gun  type  ammunition 
up  to  and  including  6  inch.  There  are  six  w6rk  cells  in  the  building.  Each 
cell  has  4  UV  detectors  and  a  preprimed  (wet)  water  deluge  system.  Operations 
are  monitored  by  closed  circuit  TV.  Currently  cells  1  and  2  are  not  equipped. 
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Cell  3  is  currently  for  breakdown  of  60  mu  and  81  mm  mortar  cartridges.  Two 
rounds  at  a  time  are  placed  on  a  holding  fixture  (steel  plate  shuttle)  in 
front  of  the  cell  by  an  operator.  At  the  proper  time,  the  holding  fixture  is 
indexed  into  the  cell  through  an  access  port.  Once  inside  the  cell,  under  the 
watchful  eyes  of  the  control  operator,  the  previously  disassembled  two  rounds 
are  picked  up  by  the  robot  (manipulator)  at  the  disassembly  "lathe"  and  placed 
in  the  holding  fixture.  Next  the  robot  picks  up  the  complete  rounds  and  brings 
them  into  clamping  position  at  the  "lathe".  With  the  rounds  held  firmly,  the 
chucks  on  either  side  of  the  cartridge  unscrew  the  fuze  on  one  end  and  the  tail 
fin  on  the  other  end.  The  head  and  tail  units  are  then  automatically  picked  up 
and  dropped  into  water  filled  containers  sitting  next  to  the  machine.  The 
mortar  body  is  carried  by  the  manipulator  to  the  shuttle  conveyor  to  the  corri¬ 
dor  outside  the  cell. 

Cells  4;  5,  and  6  are  dedicated  to  disassembly  of  gun  ammunition.  A  con¬ 
veyor  from  the  corridor  carries  projectiles  and  cartridge  cases  into  Cell  5. 

In  Cell  5,  a  pull  apart  machine  removes  the  projectile  from  the  cartridge  case 
on  fixed  munition.  For  plugged  cartridge  cases,  when  the  shell  and  case  are 
separate  (separate  gun  ammunition)  the  pull  apart  machine  is  replaced  by  an 
end  cut  off  machine  which  removes  the  end  of  the  case  by  using  a  tube  cutter 
type  device.  In  that  case,  the  projectile  enters  Cell  5  separately  and  goes 
directly  to  Cell  6.  In  Cell  6,  an  unscrewing  machine,  just  like  that  in  Cell  3, 
is  used  to  remove  fuzes  and  base  fuzes. 

The  cartridge  cases  are  moved  by  the  robot  from  the  tube  cutting  device 
into  a  horizontal  position  for  the  removal  of  a  wad  prior  to  dumping  of  the 
propellant.  The  propellant  is  dumped  from  the  cases  onto  a  conductive  rubber 
belt  conveyor  to  be  carried  to  the  accumulator  building.  Then  the  cartridge 
case  is  shuttled  into  Cell  4  via  a  conveyor.  In  Cell  4,  the  cartridge  case  is 
automatically  placed  into  a  fixture  to  punch  out  the  primer  in  its  base. 

When  the  cartridge  case  is  conveyed  back  into  the  corridor,  the  operator  must 
manually  remove  the  primer  from  the  inside  of  the  case. 

As  mentioned  above,  the  propellant  removed  from  the  cartridge  cases  is 
conveyed  to  the  Accumulator  Building.  The  conveyor  is  enclosed  and  protected 
with  UV  sensors,  and  deluge  nozzles  every  six  feet.  At  the  accumulator,  the 
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receiving  storage  hopper  is  equipped  with  two  high-level  sensors,  the  lower 
one  to  stop  operations  in  Cell  5  of  the  preparation  building  and  the  upper  one 
to  stop  the  conveyor  motion.  The  material  is  routed  from  the  storage  hopper 
to  a  vibratory  feeder  conveyor  and  finally  to  a  weigh  hopper.  The  propellant 
is  then  metered  into  type  III  or  MK  IV  containers  for  storage  or  sale.  Two 
bag  collector  units  service  the  preparation  and  accumulator  buildings.  In 
addition,  a  vacuum  system  is  available  for  special  cleanup  operations.  Four 
vacuum  cleaning  units  each  consist  of  a  cyclone  separator,  wet  collector  and 
dry  collector.  These  are  housed  in  the  cells  immediately  adjacent  to  the 
central  propellant  packaging  cell.  The  outermost  cells  hold  the  pumps  used 
to  pull  the  air  through  the  vacuum  collection  units. 

Mechanical  Removal  Building 

The  mechanical  removal  building  contains  equipment  used  to  expose  the 
interior  of  conventional  munition  items  and  to  provide  access  for  explosive 
removal  processes.  Also,  in  some  cases  on  large  munitions,  the  facility  is 
used  to  provide  vent/view  holes  in  the  item  to  facilitate  inspection  of  the 
items  prior  to  flashing  them  of  residual  materials  in  the  flashing  chamber. 

The  operations  include  trepanning  (hole  cutting),  sawing,  shearing  and 
punching  of  holes  in  munition  items.  Before  entering  the  mechanical  removal 
building,  some  items  are  washed/steamed  out  leaving  only  small  amounts 
(under  ten  pounds)  of  explosive  in  them,  with  acceptance  determined  by 
visual  inspection,  while  other  items  are  fully  loaded. 

Forklifts  are  used  to  move  items  from  the  conveying  vehicle  (driverless 
tractor  and  carts)  into  the  building  where  jib  cranes  are  employed  at  the 
corri dor-to-cell  port  of  each  cell.  On  all  large  or  heavy  items  jib  cranes 
are  used  to  place  items  onto  carriages/tooling  which  convey  the  items  into 
cells  for  processing  on"through-port"  conveyors. 

All  operations  in  the  cells  are  controlled  remotely  by  operators  in  the 
control  room  of  the  building.  Cell  1  houses  equipment  used  for  punching  holes 
in,  or  sheading,  relatively  small  munition  items  (such  as  MK1  boosters  or  MK42 
primers)  containing  appreciable  amounts  of  energetic  material.  Ammunition 
items  are  mounted  on  tooling  carrier  plates  that  ride  on  a  conveyor.  Clamping 
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elements  hold  the  tool  carriers  in  a  predetermined  position  in  the  press 
accurately  and  positively  for  shearing  and/or  punching.  Presently  primers 
longer  than  8  inches  are  to  be  sheared  into  smaller  pieces  using  an  industrial- 
type  hydraulically  operated  press. 

Cell  2  contains  a  band  saw  for  sawing  items  25  inches  in  diameter  or  less. 
Presently  the  MK  4  depth  charge  noses  are  to  be  sawed  off  by  the  band  saw  to 
expose  the  explosive  charge  for  easier  removal.  The  items  are  clamped  to  a 
tooling  carrier  which  rides  on  a  conveyor  between  the  band  saw  and  the 
corridor.  A  powered-roller  conveyor  is  used  together  with  a  ball  transfer 
table  to  manipulate  the  tooling  carriers.  Holding  clamps  fix  the  tooling 
carrier  accurately  and  positively  in  a  predetermined  position  while  sawing  is 
underway. 

Cell  3  holds  trepanning  (hole  sawing)  equipment  to  cut  a  series  of  5  inch 
diameter  vent/view  holes  simultaneously  in  large  munition  items.  A  special 
hole  cutting  machine,  equipped  with  a  shuttling  carriage,  a  deep  bed  filter  and 
an  aspirator  is  applied  in  Cell  3  to  produce  the  vent/view  holes.  The 
shuttling  carriage  rides  on  two-section  ways,  one  section  inside  the  cell  and 
the  second  section  in  the  corridor.  The  hole  cutting  machine  consists  of  a 
framework  on  which  six  horizontally  oriented,  hydraulically  powered  spindle 
heads  are  mounted  in  parallel.  A  hydraulic  cylinder  on  each  head  provides  the 
stroke.  A  "slug"  ejection  device  is  provided  on  each  head  to  push  the  cut-out 
portion  of  the  items  out  of  the  hole  saw  and  into  the  item  being  processed. 

In  conjunction  with  the  heads  six  horizontally  oriented,  hydraulically 

actuated  backstop  units  are  provided.  The  purpose  of  the  backstop  units  is  to 
resist  the  force  applied  by  the  heads  during  the  cutting  operation. 

An  aspirator  is  included  as  part  of  the  hole  cutting  equipment  to  remove 
the  coolant  accumulated  in  the  interior  of  the  item  during  hole  sawing.  Coolant 
is  removed  from  the  item  when  it  is  returned  to  the  corridor.  In  special  cases 
should  additional  vent  area  be  required  or  should  view  openings  in  other  places 
be  required,  after  the  first  array  of  holes  are  cut  and  the  item  retracted  to 
the  corridor,  the  clamps  holding  the  item  can  be  released,  the  item  rotated  on 
the  carriage,  reclamped,  and  reintroduced  to  the  cell  for  the  cutting  of  another 
set  of  holes  in  a  second  plane. 
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At  the  time  of  the  hazards  analysis  the  major  cells  were  operational 
and  equipped  with  the  appropriate  machines,  conveyors,  tooling/fixtures,  and 
jib  cranes  or  assist  devices.  Two  smaller  cells  and  an  extra  room  are  located 
in  the  Mechanical  Removal  Building  on  the  same  side  of  the  corridor  as  the 
operational  cells.  Across  the  corridor  from  the  cells  is  the  mechanical  room 
housing  all  equipment  and  utilities  necessary  for  the  operation  of  the  building. 
Also,  the  control  room  is  located  across  from  the  cells,  housing  the  controls 
necessary  to  remotely  operate  the  equipment  in  the  cells  together  with-CCTVsT 
to  observe  the  operation  in  each  cell. 

Large  Cells 

Three  large  cells  (constructed  with  frangible  walls  and  ceilings  due  to 
the  hazardous  operations  performed  on  large  munitions)  are  located  adjacent 
to  the  mechanical  removal  building.  These  house  machines  used  in  disassembly 
operations  for  large  munitions  items.  Two  of  these  cells  are  currently  in 
use.  Cell  B  is  set  up  for  cutting  open  MK  16  mines  using  a  band  saw.  Cell  C 
contains  an  unscrew  machine  for  defuzing  major  caliber  munition  items.  Cell 
A  is  presently  empty  and  could  be  used  for  temporary  storage  (within  allowable 
charge  weight  envelopes)  of  large  munition  items.  These  cells  are  serviced 
by  an  over-head  bridge  crane  system  to  move  the  large  munition  items  in  and 
out  of  the  cells. 

2.3  PRIORITY  3  SYSTEMS 
Decontamination  Building 

This  building  contains  three  furnaces  to  decontaminate  various  items. 

First,  a  rotary  type  furnace  is  used  for  small  arms  ammunition  containing  lead. 
The  items  are  placed  into  a  rotating  dumper  and  transferred  into  a  conveyor 
which  carries  them  to  the  furnace  feeder.  The  lead  items  furnace  is  a  rotary 
type  oil  burner  furnace.  At  the  burner  end,  a  narrow  opening  is  left  between 
the  furnace  and  burner  flanges  for  liquid  lead  (1)  to  drip  into  a  trough, 

(2)  be  carried  to  a  water  bath  for  cooling  and  (3)  then  be  carried  by  conveyor 
to  a  hopper  for  subsequent  removal  by  truck.  The  remaining  refuse  from  the 
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furnace  is  deposited  onto  a  second  conveyor  and  carried  to  a  magnetic  (ferrous/ 
nonferrous)  separator  where  it  is  directed  into  a  "ferrous  or  nonferrous" 
semi-trailer  positioned  under  the  separator  chute. 

A  second  rotary  furnace,  the  detonating  items  furnace,  is  quite  similar 
to  the  lead  items  furnace.  This  incinerator  does  not  have  the  spacing  between 
flanges  at  the  burner  end  since  liquid  lead  is  not  to  be  removed.  A  separate 
conveyor  is  used  to  recycle  some  of  the  refuse  to  maintain  the  proper  depth  of 
material  in  the  furnace  body.  Since  this  furnace  must  withstand  items  detonat¬ 
ing  within,  the  walls  are  stronger  than  the  lead  items  furnace,  and  the  center 
section  is  recessed  to  increase  the  residence  time  of  the  items  near  the 
center  of  the  cylinder. 

The  fifth  and  sixth  cells  in  the  decontamination  building  house  the  tray 
type  flashing  furnace.  Here,  moderate  sized  processed  items  (cleaned  out), 
which  can  be  inspected  to  preclude  presence  of  a  significant  amount  of  ener¬ 
getic  material,  will  be  decontaminated.  Items  will  be  processed  through 
a  conventional  heat-treating  type  furnace  (fire  brick  walled)  where  they  will 
be  heated  to  a  temperature  at  which  any  residual  energetic  material  decomposes 
or  burns.  Typical  items  to  be  processed  include  rocket  warheads  (e.g.  2.75  in., 
5.0  in.),  depth  charge  warheads  (e.g.  MK4,  MK5),  and  gun  ammunition  projectiles 
(e.g.  40mm  through  5"/54).  Items  are  loaded  into  trays  in  the  loading  area, 
either  manually  or  with  the  help  of  a  mechanical  assist.  The  trays  are  then 
loaded  through  a  blast  lock  into  the  furnace.  Four  trays  are  continually 
present  in  the  furnace.  At  intervals  of  approximately  7  1/2  minutes,  a  new 
tray  enters  and  a  processed  tray  leaves  the  furnace  where  it  is  checked  for 
proper  final  temperature  conditions.  Then  it  is  raised  on  a  skip  loader  where 
the  items  are  dumped  into  a  dumpster.  Trays  are  returned  by  first  being 
cooled  in  a  water  spray  chamber  and  then  sent  into  the  tray  loading  area  for 
recycling,  by  means  of  conveyor  equipment. 

Large  Items  Flashing  Chamber 

In  the  flashing  chamber,  smokeless  powder  is  used  to  burn  off  residual 
explosive  left  in  larger  items  from  which  the  bulk  of  the  explosive  already 
has  been  removed.  Decontamination  of  these  items  is  required  before  the  metal 
components  can  be  sold  as  scrap.  Deactivation  and/or  decontamination  of  con- 

IIT  RESEARCH  INSTITUTE 


10 


taminated  items  has  been  accomplished  in  the  past  primarily  by  exposing  the 
material  to  a  high  temperature  for  a  prolonged  time  such  that  the  energetic 
material  decomposes,  burns  or  detonates.  This  is  accomplished  by  placing 
the  items  in  a  bonfire  in  a  field  burn.  Short  duration  high  temperature  ex¬ 
posures  have  also  been  used  in  the  past  by  placing  smokeless  powder  in  the 
internal  cavities  of  the  item  and  igniting  the  powder.  According  to  the 
Batelle  report  (reference  4),  such  flashing  "has  been  found  to  be  effective 
in  completely  destroying  residues  of  explosive  on  or  in  the  ammunition 
items".  As  discussed  in  the  results  section,  there  is  some  question  as  to 
whether  flashing  really  will  be  effective  in  all  cases  due  to  the  shortness  of 
the  high  temperature  pulse. 

At  WADF  flashing  is  to  be  accomplished  inside  a  containment  chamber 
designed  to  prevent  products  of  combustion  from  escaping  to  the  atmosphere. 

It  is  designed  to  maintain  structural  integrity  in  the  event  of  the  detonation 
of  a  120  lb  (TNT  equivalent)  line  charge  along  the  chamber’s  axis.  During 
a  burn,  the  combustion  products  are  ducted  underground  to  a  regenerative 
heat  exchanger  (a  mass  of  steel  tubes)  and  to  a  bag  house  for  pollution  control. 

Pneumatically  driven  mine  cars  are  to  be  used  to  carry  the  contaminated 
items  from  the  DLT  (item  receiving  area)  into  the  car  preparation  enclosure, 
where  the  smokeless  powder  is  layed,  and  then  into  the  flashing  furnace.  A 
narrow  gage  track  loop  routes  the  mine  cars  into  the  chamber  and  then  back  out 
to  a  cool  off  area.  A  massive  door  covers  the  chamber's  entrance  during  a  burn, 
and  all  personnel  are  to  return  to  the  Decontamination  Building  at  that  time. 

Driverless  Tractor  System 

A  driverless  tractor  (DLT)  and  ammunition  cart  system  utilizing  Prontow 
601  vehicles  has  been  installed  at  WADF.  Two  independent  DLT  control  systems 
are  present.  One  network  (Region  1)  moves  tractors  between  the  Off  Loading 
Dock  and  the  Preparation  Building.  The  second  network  (Region  2)  moves 
tractors  between  the  Preparation  Building  and  the  various  Process  buildings 
at  the  site.  The  battery  powered  tractors  are  guided  by  a  low  frequency 
signal  transmitted  from  wires  layed  in  slots  cut  in  the  concrete  guide  paths. 

An  amber  strobe  light  indicates  when  a  vehicle  is  operating  automatically. 

A  horn  sounds  on  all  automatic  starts  and  stops.  Dynamic  braking  of  the 
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vehicle  is  accomplished  by  means  of  the  traction  motor.  A  safety  bumper  is 
attached  to  the  front  of  the  tractor  which  actuates  an  emergency  stop  if  it 
contacts  a  person  or  other  object.  High  pressure  Nitrogen  or  air  supplies 
power  for  quick  braking  of  the  train.  A  DLT  train  consists  of  a  tractor  and 
one  to  four  carts,  the  total  live  load  being  up  to  22,500  pounds.  The  minimum 
train  speed  is  2.5  mph  and  the  maximum  speed  is  3.5  m.p.h.  The  tractors  can 
be  operated  in  either  the  automatic  mode  while  on  the  guide  paths  or  in  the 
manual  mode  of  operation.  In  the  manual  mode  the  operator  stands  on  the  cart. 

A  deadman  switch  must  be  depressed  as  the  vehicle  moves  in  this  mode.  The 
vehicle  is  accelerated  using  a  foot  pedal  with  several  discrete  speed  positions. 

Off  Loading  Dock 

Munitions  items  to  be  demilitarized  enter  the  facility  at  the  Off-Loading 
dock.  The  Off-Loading  dock  is  a  conventional  earth  covered  unloading  structure 
designed  to  handle  delivery  of  energetic  materials  by  train  or  truck.  It 
consists  primarily  of  two  adjacent  earth  covered  tubes  for  unloading  trains, 
but  also  has  unprotected  docks  next  to  the  igloo  type  structure.  Items  are 
to  be  taken  from  the  unloading  dock  to  the  preparation  building  via  the  driver¬ 
less  tractor  system. 
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3»  METHODOLOGY 


Each  of  the  Priority  Reports  contains  a  section  or  appendix  describing 
the  methodology  used  in  conducting  the  hazards  analyses.  The  methodology 
is  repeated  here  to  aid  the  reader  in  understanding  the  meaning  of  the  results 
obtained. 

Basically,  the  following  steps  were  used  in  the  analyses: 

a)  Collect  Available  Information 

b)  Review  Information/Leam  System 

c)  Conduct  an  Informal  Failure  Modes  and  Effects  Analysis  (FMEA) 

d)  Develop  Fault  Tree  Logic  Diagrams  for  System  (FTA) 

e)  Quantify  Fault  Tree  (derive  scenario  probabilities) 

f)  Interpret  and  Summarize  the  FTA  Results 

For  the  purposes  of  this  program,  the  failure  modes  and  effects  analyses 
served  to  identify  types  of  consequences  and  types  of  scenarios  to  be  ex¬ 
pected  in  different  areas  of  the  WADF.  The  FMEA's  were  used  to  learn  the 
system  and  guide  the  development  of  the  fault  trees.  Fault  tree  analysis 
was  the  primary  methodology  used  to  identify  and  quantify  credible  hazards 
at  the  facility.  The  FMEA  and  Fault  Tree  methods  are  described  below: 

3.1  FAILURE  MODES  AND  EFFECTS  ANALYSIS  (FMEA) 

Failure  Modes  and  Effects  Analysis  is  a  relatively  simple  and  direct 
approach  for  identifying  basic  sources  of  failure  and  their  consequences. 

This  method  is  not  rigid  and  can  be  used  for  widely  differing  applications. 

It  is  especially  applicable  for  identifying  sources  of  malfunctions  in  hard¬ 
ware  systems  or  in  process  equipment.  The  primary  purpose  of  the  analysis 
is  to  identify  and  remove  failures  that  can  cause  hazards.  However,  as  a  side 
benefit,  the  analysis  also  leads  to  the  identification  of  failures  that  are 
in  themselves  not  hazardous  but  might  affect  the  reliability  of  the  functioning 
of  a  system.  The  reslilts  of  such  an  analysis  also  may  serve  as  an  input  to 
a  Fault  Tree  Analysis,  although  more  generally  the  two  methods  are  used 
independently. 
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A  Failure  Modes  and  Effects  Analysis  is  carried  out  by  filling  in  a  table 
having  column  headings  such  as  the  one  shown  in  Figure  1  .  This  format  is  the 
one  used  for  the  Priority  1  systems.  The  first  two  columns  list  the  system 
parts  and  procedure  steps  obtained  from  the  available  drawings,  written  des¬ 
criptions,  etc.  The  third  column  is  used  to  identify  the  different  possible 
failure  modes  for  each  entry  listed  in  the  previous  columns.  There  may  be 
several  entries  in  column  3  for  each  system  part  or  task.  Given  these  initial 
failures,  the  possible  chains  of  events  are  described  in  the  next  column,  and 
the  ultimate  effect  on  the  system  is  given  in  the  last  column.  The  Priority  1 
FMEA  tables  were  relatively  formal  and  time  consuming  to  produce.  These 
tables  were  used  primarily  as  "shopping  lists"  for  fault  tree  development,  a 
function  not  necessitating  the  formal  presentation.  In  Priority  2  and  3 
analyses  a  less  formal  FMEA  presentation  was  utilized,  although  FMEA  was 
still  used  to  provide  the  basis  for  the  fault  tree  diagramming. 

3.2  FAULT  TREE  ANALYSIS 

Fault  Tree  Analysis  is  a  powerful  method  that  has  developed  rapidly  since 
1962.  This  method  may  be  viewed  as  a  systematic  and  comprehensive  investigation 
of  a  postulated  accident  before  it  occurs.  The  term  "accident"  in  this  case 
is  used  to  signify  any  kind  of  undesired  event.  The  procedure  is  to  define 
this  undesired  event  and  to  identify  all  immediate  causes  that  could  have 
brought  it  about.  These  causes,  in  turn,  are  traced  back  through  the  system 
until  one  arrives  at  the  ultimate  causes  that  initiated  the  sequence  of 
events  that  led  to  the  undesired  event.  These  ultimate  causes  may  be  failures 
of  individual  hardware  components,  or  human  errors,  or  other  factors  which 
either  singly  or  in  combination  could  have  initiated  the  hazardous  action. 

An  immediate  result  of  such  an  analysis  is  a  graphical  representation 
of  all  basic  failures  and  the  paths  whereby  they  can  combine  to  create  the 
undesired  event.  The  method  also  can  be  used  quantitatively.  If  data  are 
available  for  the  probability  of  occurrence  of  the  basic  failures,  it  is 
possible  to  calculate  the  probability  of  occurrence  of  the  undesired  event. 

In  doing  so,  it  is  also  possible  to  identify  those  basic  failures  that  are 
most  critical,  and  the  most  critical  sets  of  events  (scenarios),  so 
priorities  can  be  established  for  taking  corrective  action. 
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An  analysis  begins  by  identifying  an  Undesired  Event  whose  causes  are  to 
be  traced.  Graphically,  this  event  is  placed  at  the  top  of  the  page  and 
represents  the  base  of  a  tree  whose  branches  are  developed  and  extend  down¬ 
ward.  Once  the  undesired  event,  also  called  a  Top  Event  is  specified,  it  is 
necessary  to  identify  the  immediate  causes  which  directly  could  cause  this  top 
event.  Each  of  these  causative  events,  in  turn,  is  further  broken  down  into 
subordinate  events.  This  process  is  continued  until  one  arrives  at  basic  input 
events  that  cannot  be  broken  down  further,  or  for  which  probability  data  are 
available  so  there  is  no  need  to  go  further. 

Figure  2  illustrates  the  diagrammatic  arrangement  of  a  fault  tree,  and 
Figure  3  identifies  the  geometric  symbolism  that  is  commonly  used  in  fault 
tree  construction.  It  is  to  be  noted  that  a  fault  tree  consists  of  three 
essential  elements  --  input  events,  logic  gates,  and  output  events.  The 
basic  logic  gates  are  of  two  kinds,  namely  OR  gates  and  AND  gates.  If  an 
output  event  can  be  caused  by  one  or  more  input  events,  either  when  each 
acts  by  itself,  or  when  they  act  together,  these  input  events  pass  through 
an  OR  gate.  On  the  other  hand,  if  an  output  event  can  be  caused  only  when 
all  input  events  must  act  in  combination,  these  input  events  pass  through  an 
AND  gate. 

This  concept  is  illustrated  in  Figure  4  where  the  top  event  is  defined 
as  the  lighting  of  the  light  bulb.  For  the  circuit  diagram  which  shows  all 
the  switches  arranged  in  series,  all  four  must  be  closed  for  the  light  to  stay 
in.  In  the  logic  diagram  for  this  arrangement,  these  four  switches  are  shown 
connected  to  an  AND  gate.  In  the  other  circuit  diagram,  where  the  four 
switches  are  arranged  in  parallel,  it  is  evident  that  the  closing  of  any  one 
switch  would  be  sufficient  to  light  the  bulb.  The  logic  diagram  for  this  case 
shows  the  four  input  events  to  pass  through  an  OR  gate.  If  the  probability 
for  each  of  the  switches  A,  B,  C,  and  D  remaining  closed  were  known,  it  would 
be  possible  to  determine  the  probability  of  the  bulb  remaining  lit  for  each 
circuit.  That  is,  the  symbolic  logic  relationships  can  be  converted  to 
algebraic  expressions  for  numerical  calculation. 
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Figure  2  Diagramatic  Arrangement  of  Fault  Tree 
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An  event  caused  by  one  or  more  other  events 
which  are  identified 


A  basic  input  event  that  does  not  require 
further  development  as  to  causes 


An  event  which  is  not  developed  further  as 
to  its  causes  because  of  lack  of  information 
or  significance 


An  event  which  is  normal  for  the  system; 
not  a  fault  or  failure  per  se 


AND  gate  -  output  event  occurs  only  if  all 
the  input  events  are  present 


OR  gate  -  output 
more  of  the  input 


event  occurs  when  one  or 
events  are  present 


V 


INHIBIT  gate  -  output  event  is  caused  by. 
input  event  only  if  specified  condition  is 
satisfied 


Attached  to  logic  gate  to  specify  a  condition 


Continuation  symbol  to  identical  portion 
of  fault  tree 

A  Transfer  In 


Transfer  Out 

Continuation  symbol  to  similar  (but  not 
identical)  portion  of  fault  tree 


^  Transfer  In 
Transfer  Out 

Figure  3  SYMBOLS  USED  IN  FAULT  TREE  CONSTRUCTION 


3.3  QUANTIFICATION 


IITRI  has  a  fault  tree  analysis  computer  program  for  evaluating  the  fault 
tree  diagrams.  The  first  portion  of  the  computer  code  uses  a  matrix  approach 
known  as  the  Boolean  Indiated  Cut  Set  (BIC)  method  to  reduce  the  tree  logic 
to  a  list  of  scenarios  (cut  sets)  that  "lead  to"  the  undesired  top  event  of 
the  tree.  These  cut  sets  are  the  hazard  scenarios  that  must  be  evaluated. 

Each  basic  event  on  the  fault  tree  must  be  provided  a  probability  of 
occurrence  or  a  failure  frequency  (with  associated  downtime)  for  quantifica¬ 
tion  of  the  tree.  Four  types  of  data  must  be  compiled  to  quantify  the  trees: 

1.  System  Scheduling  Data 

2.  Part  Reliabilities 

3.  Human  Error  Probabilities 

4.  Initiation  Probabilities 

Scheduling  information  was  largely  inferred  from  the  Batelle  Report 
(reference  4).  Part  reliability  data  has  been  compiled  at  IITRI  during  prior 
hazards  and  reliability  analyses  from  numerous  sources.  The  primary  source 
of  reliability  data  used,  however,  was  a  compilation  of  non-el ectronic  parts 
data  developed  by  the  Reliability  Analysis  Center,  an  IITRI  organization  in 
Rome,  New  York  (Reference  5).  Human  error  data  has  been  compiled  under  a 
recent  project  conducted  by  IITRI  for  the  Chicago  Transit  Authority  (Refer¬ 
ence  6)  and  that  was  the  primary  source  for  human  error  probabilities  used. 

For  initiation  probabilities,  the  primary  source  of  data  was  the  Hercules 
Hazards  Analyses  for  WADF  presented  in  the  Batelle  report  (Reference  4).  The 
most  sensitive  material  for  which  data  was  available  was  used  for  each  stimulus 
type.  HBX-1  data  was  adopted  for  many  of  the  explosive  cases  studied.  In 
addition,  there  were  numerous  cases  where  data  was  unavailable  and  subjective 
judgements  had  to  be  used.  For  example,  the  probability  that  a  significant 
amount  of  explosive  would  remain  is  a  vessel  during  maintenance  operations 
or  that  a  local  initiation  would  propagate  into  the  bulk  of  material  present 
were  not  easily  quantified.  Therefore,  judgements  had  to  be  used  to  establish 
probability  values  for  the  analysis. 
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The  criteria  for  safety  adequacy  is  stated  in  the  contract  as: 

"The  minimum  acceptable  level  of  risk  for  the  operation  and 
maintenance  for  the  entire  WADF  complex  and  any  subsystem  is 
97.5  percent  probability  with  a  95  percent  confidence  level 
that  a  category  1  or  2*  accident  will  not  happen  during  25 
years  of  operation  (40  hours  per  week)." 

This  translates  to  specifying  that  the  hazard  incident  probability  per 
year  for  the  entire  facility  is  less  than  or  equal  to  1/1000  with  a  95  percent 
confidence  level.  The  95  percent  confidence  level  criteria  has  been  evaluated 
for  the  facility  using  the  dominant  cut  sets  derived  for  the  different  plant 
sections  as  a  basis.  These  results  are  discussed  in  the  next  section. 


*  Hazard  categories  are  defined  as  follows: 

Category  1  -  Catastrophic.  May  cause  death  or  system  loss.  System  loss 
shall  be  defined  as  damage  which  results  in  the  loss  of  25  percent  or  more 
production  capability  and  requires  30  days  or  more  to  repair. 

Category  2  -  Critical.  May  cause  severe  injury,  severe  occupational  illness 
or  major  system  damage.  Major  system  damage  shall  be  defined  as  that  which 
results  in  more  than  10  percent  loss  of  production  capability  and  requires 
more  than  3  days  to  repair. 

Category  3  -  Marginal.  May  cause  minor  injury,  occupational  illness  or 
minor  system  damage.  Minor  system  damage  shall  be  defined  as  that  which 
results  in  10  percent  or  less  loss  of  production  capability  or  requires 
3  days  or  less  to  repair. 

Category  4  -  Negligible.  Will  not  result  in  injury,  occupational  illness 
or  system  damage. 
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4.  FAULT  TREE  ANALYSIS  RESULTS  IN  TERMS  OF 
THE  95  PERCENT  CONFIDENCE  LEVEL 

In  the  three  priority  reports  for  this  program  (ref.  1,  2,  and  3)  fault 
trees  are  presented  for  each  plant  section  at  WADF  and  quantified  using  mean 
probability  values  for  the  basic  events.  Recommendations  have  been  developed  on 
the  basis  of  those  results. 

As  required  under  the  contract  for  this  program,  the  probabilistic  results 
of  the  fault  tree  analyses  must  also  be  evaluated  in  terms  of  the  95  percent 
confidence  level.  A  "Monte  Carlo"  analysis  was  utilized  for  this  purpose.  This 
was  accomplished  by  describing  each  basic  event  as  a  distribution  of  probabili¬ 
ties,  rather  than  a  discrete  value  as  was  done  previously.  Lognormal  distribu¬ 
tions  were  chosen  to  describe  the  basic  components  in  all  cases,  since  the  log¬ 
normal  distribution  is  a  fairly  realistic  model  for  part  failures,  human  errors, 
and  initiation  probabilities.  A  random  number  generator  was  then  used  to  sample 
off  of  the  basic  component  distributions.  The  component  probabilities  derived 
in  this  way  were  then  combined  using  normal  fault  tree  numerics  to  derive  cut 
set  and  top  event  probabilities  for  a  given  trial.  This  procedure  was  repeated 
within  the  computer  code  1200*  times  using  revised  random  numbers  for  each 
component  for  each  trial  to  develop  cut  set  and  top  event  probability  distribu¬ 
tions.  The  50%  (median)  and  95%  confidence  levels  were  determined  from  the 
compiled  distributions  by  computing  the  area  under  the  curve  up  to  where  50%  and 
95%,  respectively,  of  the  computed  probabilities  have  occurred. 

Monte  Carlo  analyses  were  accomplished  only  for  the  highest  probability 
cut  sets  identified  previously  in  ref.  1,  2,  and  3  using  mean  values.  Systems 
showing  very  low  top  event  probabilities  were  omitted  from  the  Monte  Carlo 
analysis.  For  high  probability  systems,  only  the  highest  two  orders  of  magni¬ 
tudes  cut  sets  were  included,  since  the  highest  two  orders  of  magnitude  have 
been  determined  to  dominate  the  results. 


*  1200  trials  was  sited  in  WASH  1400— -(Ref.  7)  as  being  the  number 

required  to  obtain  a  fairly  smooth  top  event  distribution  and  for  which 
additional  trials  give  little  additional  accuracy. 
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It  should  be  noted  that  the  narrowness  of  a  probability  distribution  is 
indicative  of  the  "certainty"  of  the  input  values  used.  When  a  cut  set  has  a 
high  computed  probability  and  a  narrow  distribution  (e.g.,  the  95%  confidence 
level  is  one  order  of  magnitude  above  the  median  value  or  less),  the  results 
are  reasonably  certain  and  modifying  the  system  or  procedures  is  the  appro- 
priate  corrective  action.  Conversely,  if  a  high  probability  cut  set  has  a  wide 
distribution  (e.g.,  95%  confidence  level  approaches  two  orders  of  magnitude 
above  the  median  value  or  higher),  this  indicates  that  insufficient  or  inade¬ 
quate  data  was  available.  The  appropriate  action  in  this  case  is  to  do  addi¬ 
tional  testing  or  analyses  to  better  solidify  the  quantitative  inputs. 

The  computer  output  for  the  Monte  Carlo  analyses  are  presented  in  the 
Appendix  to  this  report.  The  results  are  summarized  in  Table  1.  The  error 
factor  shown  in  the  table  is  simply  the  ratio  of  the  probability  at  the  95% 
confidence  level  to  the  median  (50%)  value.  As  mentioned  above,  error  factors 
on  the  order  of  10  indicate  a  high  degree  of  conficence,  and  modifications  of 
the  system  or  procedure  should  be  accomplished  in  most  of  these  cases.  Very 
high  error  factors,  e.g.,  approaching  100,  indicate  that  further  testing  or 
analyses  should  be  done  to  better  quantify  the  results.  The  error  factors 
derived  in  the  Monte  Carlo  analysis  ranged  from  2  to  122,  with  most  cases 
greater  than  10.  This  was  expected  in  that  most  of  .the  high  probabjli ty 
(dominant)  scenarios  had  a  high  probability  because  of  conservative  assumptions 
that  had  to  be  made  because  of  the  uncertainties  in  the  inputs. 

The  recommendations  presented  in  the  next  section  generally  reflect  the 
results  of  the  Monte  Carlo  analyses.  However,  in  some  circumstances  the 
results  had  to  be  tempered  by  practical  considerations. 
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TABLE  1 .  SUMMARY  OF  RESULTS  OF 
MONTE  CARLO  ANALYSIS 

Typical  Error 

Factor,  or  Range  Comments/Conclusions 


10-34  Dominant  Scenarios  involve  runaway 

reactions.  Significant  uncertainty  is 
associated  with  the  specific  conditions 
at  which  runaway  will  be  induced. 
Simulation  tests  are  recommended. 

15-61  The  great  majority  of  dominant  scenarios 

involved  equipment  damage  or  (less  fre¬ 
quently)  initiation  due  to  projectile 
impact.  The  large  uncertainty  here 
is  due  to  the  human  error  probabilities 
and  the  probability  that  damage  or 
initiation  will  result  from  an  impact. 

27  Prolonged  Process  Shutdown  due  to 

Yellow  D  "plateout"  problems.  The  high 
error  factor  arises  from  uncertainty  in 
the  time  required  for  settling  to  occur 
and  the  severity  of  "plateout"  required 
for  a  prolonged  hold. 

10-34  Dominant  Scenarios  involve  runaway 

reactions.  Significant  uncertainty  is 
associated  with  the  specific  conditions 
at  which  runaway  will  be  induced. 
Simulation  tests  are  recommended. 

(not  evaluated  due  to  low  probabilities 
derived  using  mean  values) 


(not  evaluated  due  to  low  probabilities 
derived  using  mean  values) 


15-35  Item  Impact  Causing  Equipment  Damage 

or  Initiation.  The  uncertainty  is 
associated  with  the  probabilities  that 
equipment  damage  or  initiation  will 
occur  given  that  impact  occurs. 
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TABLE  1 .  SUMMARY  OF  RESULTS  OF 

MONTE  CARLO  ANALYSIS  (cont.) 

Typical  Error 

System  Factor,  or  Range  Comments/Concl usions 

•  Cell  1  (not  evaluated  due  to  low  probabilities 

derived  using  mean  values) 


9  Cells  3, 4, 5, 6  12-23  Dominant  scenarios  involved  equipment 

damage  or  initiation  due  to  an  item 
impacting  equipment  or  being  dropped 
(e.g.,  item  dropped  into  drop  tank  over¬ 
filled  with  items,  not  adequately  filled 
with  water,  or  not  positioned  at  drop 
location.  Uncertainty  in  these 
scenarios  is  related  to  the  criteria  for 
significant  damage  or  item  impact 
initiation.  Although  item  impact 
initiation  tests  appear  to  be  indicated, 
too  many  trials  would  be  necessary  in 
this  case  and  testing  is  considered  to 
be  impractical.*  Therefore,  protective 
measures,  e.g.,  to  assure  that  the  drop 
tank  is  full  of  water,  and  not  over  full 
with  items,  are  suggested. 

Initiation  due  to  tool  dropped  into  Type 
III  container  while  vacuum  system  is  . 
being  emptied  or  due  to  forklift  pene¬ 
tration  into  container  or  vessel. 
Procedural  recommendations  (tool  tied 
to  operator,  area  wetted,  water  in 
container,  etc.)  are  pertinent  here. 

26-38  Impact  initiation  during  insertion  of 

lids  into  propellant  containers  due  to 
the  wrench  or  lid  being  dropped  onto 
the  lip  or  due  to  rough  handling  of 
the  tool.  The  high  uncertainty  here 
is  attributable  to  defining  the  proba¬ 
bility  that  the  lip  is  contaminated  at 
the  impact  location  and  determining 
whether  the  reaction  would  propagate  to 
inside  the  container.  Procedural 
precautions  are  suggested. 

12  Impingement  initiation  caused  by  a  pinch 

valve  rubber  boot  leak.  Uncertainty 
is  attributable  to  not  having  data  for 
the  reliability  of  the  rubber  boot. 
Better  reliability  data  would  be  help¬ 
ful  in  this  regard. 


Accumulator  5_7 

Building 


*  Conversely,  since  the  DOD  has  such  a  large  amount  of  items  to  be  disposed 
of,  such  testing  may  not  be  impractical,  at  least  in  terms  of  the  cost  of 
the  test  materials.  ?c 


System 


TABLE  1 .  SUMMARY  OF  RESULTS  OF 

MONTE  CARLO  ANALYSIS  (cont.) 


Typical  Error 

Factor,  or  Range  Comments/Concl usions 


16-28 


16 


48 


Impact  Initiation  during  maintenance  due 
to  a  dropped  tool  or  rough  handling  of 
the  tool.  Uncertainty  is  attributable 
to  the  probability  that  the  ignition 
source  is  at  the  propellant  and  for  how 
often  emergency  maintenance  will  be 
required. 

Initiation  due  to  a  propellant  container 
being  dropped  during  jib  crane  maneuvers. 
The  uncertainty  here  is  in  defining  the 
container  impact  initiation  probability. 
The  very  large  number  of  trials  that 
would  be  required  makes  testing  impracti¬ 
cal  in  this  case. 

ESD  initiation  due  to  operator  wearing 
ungrounded  shoes.  Uncertainty  is  due 
to  the  reaction  propagation  probability 
combined  with  human  error  probabilities. 


Mechanical 
Removal  Building 

o  Cell  #1 


9  Cell  #2 


15-17  The  dominant  scenarios  involved  impact 

initiation  of  primer  tubes.  Uncertainty 
is  due  to  initiation  probability, 
therefore,  testing  is  recommended. 

The  large  number  of  trials  required 
may  make  testing  impractical  here  also. 

11-26  The  dominant  scenarios  involved  intiation 

of  a  MK4  charge  head  as  it  falls  (sawn 
off)  into  the  collection  tray  or  as  it  is 
thrown  onto  the  floor  after  sawing.  The 
major  uncertainty  is  related  to  the 
likely  impact  location.  In  this  case, 
the  extremely  high  probability  of  the 
event  indicates  redesign  of  the  fixture 
to  prevent  release  of  the  sawn  off  head. 

11  ESD  initiation  of  a  sectioned  item  due 

to  the  plastic  sheet  used  to  cover  the 
item.  Recommend  use  of  conductive 
plastic. 
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TABLE  1 .  SUMMARY  OF  RESULTS  OF 

MONTE  CARLO  ANALYSIS  (cont.) 

Typical  Error 

Factor,  or  Range  Comments/Conclusions 

12-19  Several  scenarios  concerned  initiation 

of  an  item  during  sawing  due  to  binding 
of  the  saw  blade  or  thermal  initiation 
during  normal  sawing.  Uncertainty  is 
related  to  whether  operating  conditions 
(force,  cutting  speed,  or  misalignment) 
will  cause  initiation.  Recommend  that 
"safe"  conditions  be  identified  for  all 
items  to  be  cut  and  strict  controls  be 
enforced  to  assure  that  the  proper 
settings  are  used. 

16  Initiation  due  to  a  tool  being  dropped 

onto  contamination  during  servicing  of 
the  filter  media.  The  major  uncertainty 
is  whether  the  resultant  fire  would 
propagate  back  to  the  filter  and  involve 
a  significant  amount  of  material. 

19  Initiation  due  to  a  forklift  prong 

penetrating  an  item.  The  major  uncer¬ 
tainty  is  associated  with  whether  the 
prong  will  penetrate  the  item  or  merely 
push  it  aside. 

17,  19  The  dominant  scenarios  for  Cell  3 

involved  initiation  of  contamination  on 
the  carriage/rollers  during  loading  of 
items  and  initiation  due  to  forklift 
prong  penetration  into  an  item.  The 
uncertainty  was  due  to  difficulty  in 
defining  whether  the  reaction  will 
propagate  to  involve  a  large  quantity  of 
material . 

14-26  ESD  initiation  due  to  ungrounded  shoes 

worn  by  an  operator.  The  uncertainty 
in  this  scenario  is  attributable  to 
defining  the  probability  that  the  spark 
will  occur  at  contamination  present. 

15  Item  dropped  during  jib  crane  maneuver 

causing  initiation.  The  uncertainty 
is  due  to  defining  the  item  impact 
initiation  probability. 
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TABLE  1 .  SUMMARY  OF  RESULTS  OF 

MONTE  CARLO  ANALYSIS  (cont.) 

Typical  Error 

Factor,  or  Range  Comments/Concl usi ons 

13  The  highest  probability  scenario 

involved  ESD  initiation  from  the 
plastic  sheet  used  to  cover  the  sectioned 
items.  The  major  uncertainty  is  the 
spark  energy.  It  is  recommended  that 
conductive  plastic,  or  equivalent,  be 
used. 

20  This  scenario  involves  initiation  due 

to  a  sectioned  item  falling  onto  the 
exposed  end  when  it  is  knocked  off  a 
DLT  cart  by  a  forklift.  The  major 
uncertainty  is  the  probability  that  the 
item  will  fall  onto  the  exposed  end. 

10,  17  Initiation  due  to  a  forklift  prong 

impacting/penetrating  a  sectioned 
item.  The  major  uncertainty  is  whether 
the  prong  will  penetrate  or  merely 
shove  the  item  aside. 

14-17  Equipment  damage  due  to  an  item  being 

moved  into  equipment  during  bridge 
crane  or  forklift  maneuvers.  The  major 
uncertainty  is  the  probability  that 
the  equipment  will  be  damaged  signifi¬ 
cantly  by  such  an  impact. 

7  Initiation  due  to  a  tool  being  dropped 

onto  contamination  while  the  filter 
media  is  serviced.  There  were  no 
major  uncertainties.  Recommend  con¬ 
trols  to  prevent  impact  initiated  by 
dropped  tool,  e.g.,  tool  connected 
by  a  cord  to  the  arm  and  keeping  the 
area  wet. 

17-118  Initiation  during  cutting  due  to  mis¬ 

aligned  saw  blade,  due  to  thermal 
initiation  during  normal  sawing,  or  due 
to  incorrect  force/ speed  setting. 

Large  uncertainty  due  to  not  knowing 
conditions  at  which  initiation  will 
occur.  Recommend  study  to  determine 
these  conditions  for  all  items  to  be 
processed  and  controls  to  assure  that 

the  proper  conditions  are  applied. 
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TABLE  1 .  SUMMARY  OF  RESULTS  OF 

MONTE  CARLO  ANALYSIS  (cont.) 


Typical  Error 

System  Factor,  or  Range 

Large  Cell  C  13-19 


Comments/Conclusions 

The  majority  of  the  dominant  scenarios 
in  Large  Cell  C  involved  initiating  of 
an  item  or  fuze  by  impact.  The  primary 
source  of  uncertainty  in  these  scenarios 
is  due  to  the  item  impact  initiation 
probability.  Although  testing  to 
determine  this  value  is  indicated,  the 
extremely  large  number  of  trials  makes 
that  recommendation  impractical. 


Decontamination 

Building 

8  Lead  Items  (not  evaluated  due  to  low  probabilities 

Furnace  derived  using  mean  values) 


®  Detonating  Items  The  only  dominant  scenarios  for  the 

Furnace  45-64  detonating  items  furnace  involves  items 

continuing  to  detonate  upon  exiting  the 
furnace  due  to  latent  heat.  The  major 
uncertainty  in  this  scenario  is  in  part 
due  to  defining  the  probability  that 
major  system  damage  will  occur  as  a 
result. 


6  Tray  Type 
Furnace 


32,  122  Explosion  in  furnace  due  to  full  or 

partially  full  items  being  processed. 
The  high  uncertainty  is  due  to  diffi¬ 
culty  in  determining  the  frequency  that 
full  or  partially  full  items  will  be 
routed  to  the  Decontamination  Building. 
Procedural  and  DLT  System  Controls  to 
prevent  this  are  suggested. 

10,  14  Fire  in  Bag  House  due  to  recuperator 

heat  transfer  degradation.  The  uncer¬ 
tainty  is  attributable  to  defining  the 
frequency  of  duct  blockage  and  heat 
transfer  surface  degradation. 

5  Equipment  damage  due  to  the  building 

crane  dropping  a  heavy  item.  General 
recommendations  related  to  training, 
licensing,  and  certifying  of  personnel 
are  pertinent  here. 
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TABLE  1 .  SUMMARY  OF  RESULTS  OF 

MONTE  CARLO  ANALYSIS  (cont.) 


Typical  Error 

System  Factor,  or  Range  Comments/Concl usions 

Large  Items  24,  27  Operator  becomes  charged  due  to 

Flashing  Chamber  ungrounded  concrete  pad  outside  of 

building  and  ESD  ignites  contamination 
in  item.  Uncertainty  is  attributable 
to  whether  or  not  significant  charging 
actually  will  occur.  It  is  recommended 
to  keep  the  pad  wetted  down  to  assure 
that  the  concrete  maintains  a  reasonably 
high  electrical  conductivity. 


21  Impact  initiation  of  contamination  on 

mine  car  as  an  operator  is  raking  out 
the  sand  bed.  The  major  uncertainty  in 
this  scenario  is  in  defining  how  likely 
it  is  that  the  rake  can  impact  metal 
at  the  bottom  of  the  car  at  the  location 
of  contamination  present. 

9-20  Operator  is  injured  by  not  getting  away 

fast  enough  while  using  non-electrical 
ignition  of  a  powder  train  to  start 
flashing.  In  this  case,  it  is  simply 
recommended  to  use  remote  electrical 
ignition  of  the  smokeless  powder  instead. 


7-17  Impact  initiation  of  an  item  or  smokeless 

powder  container  due  to  it  being  dumped 
off  of  a  DLT  cart,  dropped  by  a  jib  crane, 
forklift  impact,  items  not  properly 
braced  on  a  mine  car,  etc.  Some  uncer¬ 
tainty  in  defining  the  initiation  proba¬ 
bility  accounts  for  the  wide  distribu¬ 
tions  for  these  scenarios. 


38  Chamber  explosion  due  to  too  much  pro¬ 

pellant  packed  into  the  item  to  be 
processed.  The  required  human  errors 
account  for  the  high  uncertainty  in 
this  scenario.  Rigid  management  controls 
should  be  enforced. 

2  Train  collision  while  positioning  or 

removing  gondolas.  This  is  a  single 
failure  rate  derived  from  railroad 
statistics. 
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TABLE  1 .  SUMMARY  OF  RESULTS  OF 

MONTE  CARLO  ANALYSIS  (cont.) 

Typical  Error 

System  Factor,  or  Range  Comments/Concl usions 

Driverless  Tractor  32  The  only  dominant  unique  scenario  in 

System,  Off- Loading,  this  fault  tree  is  that  of  an  item 

Dock,  and  Magazines  falling  out  of  a  box  car  onto  an  opera- 

1  tor  at  the  unloading  dock  due  to  the 

load  having  shifted  during  transport. 
The  uncertainty  in  this  scenario  is 
attributable  to  the  estimate  of  how 
often  a  load  will  have  shifted  during 
transport  such  that  it  will  fall  onto 
the  operator  when  the  box  car  door  is 
opened.  Extreme  care  should  be 
exercised  by  operators  unloading  box 
cars  because  of  this  possibility. 

Use  of  a  come-along  is  recommended. 
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5.  CONCLUSIONS  AND  RECOMMENDATIONS 


In  this  section,  the  conclusions  and  recommendations  presented  in  the  three 
Priority  Reports  are  consolidated.  Additional  suggestions,  in  the  category 
of  "good  practices"  are  also  included,  although  not  all  of  these  emerged  directly 
from  the  hazards  analysis.  The  recommendations  and  conclusions  have  been 
prioritized  using  descriptive  terms  such  as  (in  decreasing  order  of  urgency) 
"strongly  recommended",  "recommended",  "suggested/good  practice",  and  "concluded". 
General  recommendations  that  apply  to  more  than  one  area  are  presented 
separately  at  the  end  of  the  section. 

North  Tower  and  Refining  Building 

•  It  is  strongly  recommended  that  a  comprehensive  experimental 
program  be  conducted  to  evaluate  the  potential  for  thermal . 
explosion  in  liquid  explosive  holding  vessels  with  realistic 
contaminants  and  aged  materials.  The  validity  of  small  scale 
tests  for  obtaining  parameters  such  as  pre-exponential  factor 
and  activation  energy  should  be  investigated  by  conducting 
several  large  scale  simulation  tests,  with  and  without  agita¬ 
tion.  Localized  effects  of  a  contaminant  should  be  considered 
since  they  may  really  dominate  incidents  of  this  type.  It  is 
expected  that  tests  of  the  type  conducted  at  China  Lake  (e.g. 

Ref.  8  )  or  in  Holland  (Ref.  9  )  with  additional  explosives 
and  contaminants,  and  a  wider  range  of  conditions  will  serve 
well  to  better  map  out  problem  areas. 

•  The  options  available  for  protecting  against  thermal  explosion 
at  WADF  should  be  evaluated  further  to  select  the  best  approach 
balancing  the  effectiveness  of  the  approach  with  the  costs 
required  for  modification  of  equipment.  The  existing  system 

is  not  expected  to  provide  much  protection  in  the  event  of  a 
runaway  reaction.  The  options  warranting  evaluation  include 
use  of  an  under-surface  deluge  with  swirl  and  enhanced  agitation. 

•  The  valves  in  the  drain  lines  beneath  the  melt  kettles  and 
separator  should  be  moved  as  close  as  possible  to  the  vessel 
to  eliminate  the  dead  space  in  the  pipes. 

t  In  order  to  better  sense  the  onset  of  a  runaway  reaction  the 
use  of  numerous  thermocouples  at  a  variety  of  locations  inside 
the  vessel  should  be  considered.  The  onset  of  runaway  will 
probably  be  localized  and  a  single  thermocouple  is  not  likely 
to  be  at  the  right  place.  The  more  locations  that  are  kept 
under  observation,  the  better  the  chance  is  that  the  event  will 
be  sensed  early. 
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•  In  the  event  of  a  runaway  reaction,  dumping  the  contents  of 
the  vessel  to  pans  using  the  existing  system  should  be  accom¬ 
plished  if  no  better  alternative  exists.  Operators  should  be 
made  aware  that  the  dump  may  not  be  fast  enough,  and  they  should 
evacuate  the  area  quickly . 

•  Use  of  plastic  tipped  lances  for  steamout  in  the  North  Tower 
should  be  considered.  A  plastic  tip  would  reduce  the  chance 
for  impact  initiation  during  steamout,  but  the  potential  for 
ESD  should  be  evaluated  before  making  such  a  change. 

•  Similarly,  use  of  a  plastic  coated  dipstick  in  the  separator 
should  be  considered.  In  addition,  a  procedure  or  device  should 
be  developed  to  assure  the  dipstick  is  cleaned  off  prior  to  re¬ 
entry  into  the  vessel. 

•  During  major  maintenance  involving  removal  of  melt  kettle  or 
separator  covers,  extreme  care  should  be  taken  to  assure  that 
the  impeller  will  not  contact  the  vessel  wall  during  operation. 
This  can  be  accomplished  by  incorporating  several  independent 
inspections  of  the  equipment  prior  to  operation  as  part  of  the 
overall  maintenance  procedure. 

t  The  screen  in  the  line  leading  into  the  North  Tower  separator 
vessel  should  be  checked  periodically  for  structural  integrity. 

As  long  as  that  screen  is  in  good  condition,  foreign  parts  or 
large  pieces  of  contaminant  cannot  enter  the  equipment  below 
during  normal  operation.  The  possibility  still  exists  that 
something  will  be  left  behind  after  maintenance  actions,  however. 

•  The  credibility  should  be  evaluated  for  the  scenario  mentioned 
in  the  previous  section  in  which  a  piece  of  solid  explosive 
forms  in  a  low  point  in  the  drain  base  between  the  tilt  table 
to  the  separator  vessel  and  breaks  loose  impacting  the  grate 
above  the  separator.  The  velocity  achieved  by  the  piece  and 
the  potential  for  initiation  are  uncertain.  Simulation  tests 
are  suggested  to  better  evaluate  this  potential  hazard. 

•  It  is  suggested  that  a  vacuum  trap  be  put  in  the  lines  between 
the  melt  kettle  and  the  vacuum  pump.  This  will  essentially 
eliminate  the  possibility  of  liquid  explosive  getting  into  the 
pump, 

•  Prior  to  major  maintenance  on  vessels  in  the  facility,  the 
vessels  should  be  thoroughly  drained  and  steamed  out.  Even 

if  a  film  of  explosive  remains  in  the  vessel,  the  potential  exists 
for  the  film  to  "flash"  and  injure  the  maintenance  personnel 
present. 

•  Similarly,  throughout  the  North  Tower  and  Refining  Building,  the 
piping  and  ledges  present  are  a  maze  of  collection  points  for 
explosive  dust  layers  to  develop.  Cleanup  is  quite  difficult. 

The  major  potential  hazards  are  "flash"  reactions  that  could 
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injure  personnel,  as  well  as  a  possible  "train"  for  the  reaction 
to  get  to  a  larger  quantity  of  material,-  elsewhere  in  the 
building,  e„g.  an  open  item.  The  best  solution  to  this 
problem  is  frequent  hose-down  of  all  the  equipment,  piping, 
ledges,  etc. 

•  Insulation  on  steam  lines  within  these  buildings  could  pose 
a  contamination  problem.  If  a  crack  develops  in  the  shell  and 
explosive  dust  builds  up,  a  fire  could  eventually  develop.  Fre¬ 
quent  inspections  should  be  made  of  the  insulations  condition. 

Rotoclone  Cleaners  and  Duct  Work. 


t  Air  handling  ducts  should  be  inspected  and  cleaned  frequently 
to  avoid  any  significant  buildup  of  an  explosive  dust  layer 
inside  the  ducts. 

•  The  Rotoclone  should  be  tested  frequently  to  assure  efficient 
operation.  The  inside  walls  of  equipment  and  ducts  downstream 
of  the  scrubber  should  be  inspected  to  assure  that  a  dust/ 
residue  layer  is  not  developing. 

South  Tower 


•  Yellow  D  solubility  in  water  is  extremely  sensitive  to  tempera¬ 
ture,  This  results  in  a  real  potential  for  plateout  of  yellow  D 
within  the  south  tower  equipment  requiring  hazardous  cleanup. 
Therefore,  it  is  suggested  that  alternate  methods  of  treating 
Yellow  D  be  considered, 

•  Yellow  D  is  an  extremely  toxic  material.  Great  care  must  be 
exercised  to  protect  operators  from  becoming  exposed  to  this 
material.  It  should  also  be  recognized  that  A-3  being  processed 
in  the  South  Tower  can  become  contaminated  with  Yellow  D  if 
equipment  is  not  thoroughly  cleaned  between  operations.  Per¬ 
sonnel  handling  the  A-3  may  then  be  exposed  to  Yellow  D  without 
knowing  it. 

•  Transport  of  Yellow  D  to  the  bulk  incinerator  is  of  concern. 

The  transport  containers  apparently  have  been  designed  such 
that  the  temperature  will  remain  sufficiently  high  during 
transport  to  avoid  plate  out.  If  an  unanticipated  delay  occurs 
in  transit  (this  is  not  that  unlikely)  Yellow  D  could  plate  out 
within  the  vessel.  Redissolving  the  Yellow  D  before  dumping 
the  contents  into  the  slurry  tank  at  the  bulk  incinerator  is 
likely  to  be  a  hazardous  operation. 

•  The  structural  integrity  of  the  floor  grating  within  the  South 
Tower  should  be  evaluated  to  assure  that  the  heavy  items  that 
are  to  be  handled  will  not  fall  through  the  grating  if  an  item 
is  set  down  on  the  fourth  level. 


1 1 T  RESEARCH  INSTITUTE 


34 


.  /. 


\ 


Bulk  Explosives  Disposal  Building 

•  Assure  that  the  hydraulic  fluid  being  used  has  been  evaluated 
for  compatibility  with  the  explosives  and  propellants  to  be 
processed  -  this  really  should  be  done  for  the  total  plant. 

On  the  ground  level  cement  floor  it  is  quite  likely  that  some 
hydraulic  fluid  could  be  mixed  with  explosive  residue. 

•  A  compatibility  library  should  be  set  up  at  the  WADF.  Any 
time  new  combinations  of  materials  will  come  in  contact,  the 
library  should  be  consulted.  For  combinations  for  which  no 
data  exists,  a  laboratory  should  be  set  up  to  run  the  required 
compatibility  tests. 

•  Tests  should  be  conducted  to  simulate  large  chunks  of  explosive 
being  put  into  the  grinder.  It  should  be  determined  whether  such 
large  pieces  will  ignite  by  impact  in  the  grinder  with  and  with¬ 
out  water  present.  The  consequence  of  such  a  reaction  is  also 

of  concern  -  i.e.  will  the  result  be  "fire  cracker"  type  explosions 
or  a  more  massive  event  with  propagation  between  pieces  of 
material?  It  is  anticipated  that  the  "fire  cracker"  type  event 
will  occur  and  possibly  could  damage  the  equipment. 

•  Although  great  care  is  taken  to  prevent  steel  drums  containing 
waste  material  from  impacting  each  other  in  the  bulk  explosives 
disposal  building,  it  is  possible  that  drums  can  impact  each 
other  while  stacked  more  closely  enroute  to  the  building.  Care 
should  be  taken  to  assure  the  outsides  of  the  drums  are  clean 
prior  to  transport  and  that  the  drums  somehow  be  spaced  on  the 
cart. 

•  It  is  suggested  that  a  side  chute  and  automatic  gate  be  incor¬ 
porated  at  the  metal  detector  on  the  conveyor  feeding  the  grinder. 
If  metal  is  detected  in  the  present  arrangement  it  appears  that 

it  still  could  be  carried  into  the  grinder  by  residual  water 
flow.  A  side  chute  with  a  gate  would  serve  to  prevent  metal 
from  getting  into  the  grinder. 

•  When  changing  the  grinder  blades,  the  grinder  wheel  should 
not  be  rested  on  the  floor  grating,  unless  the  structural 
integrity  of  the  grating  has  first  been  evaluated  to  assure 
that  the  grinder  will  not  fall  through. 

•  Experience  shows  that  explosive  contaminants  can  be  expected 
beneath  the  grinder  blades,  and  on  the  screw  threads.  The 
grinder  should  therefore  be  decontaminated  before  going  to 

the  maintenance  shop  for  blade  replacement,  in  order  to  protect 
maintenance  personnel  from  initiation  hazards.  Long  duration 
heat  decontamination  would  be  desireable  from  the  safety  stand¬ 
point  but  should  be  evaluated  first  to  assure  that  warping  of 
parts  or  altered  heat  treat  would  not  result.  An  acceptable 
alternative  may  be  keeping  the  grinder  wet  with  a  compatible 
wetting  agent  during  disassembly. 
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Process  Water  Treatment  Plant 


•  It  is  recommended  that  tests  be  conducted  to  determine  the 
catalytic  effects,  if  any,  of  anthracite  coal  on  the  decompo¬ 
sition  of  explosives  and  mixtures  of  explosives  present  in 
the  process  water  treatment  pi  ante 

•  It  is  normal  practice  in  propellant  and  explosives  facilities 
to  use  nonmetal  shovels  instead  of  metal  ones.  It  is 
assumed  that  this  will  also  be  the  case  at  WADF.  The  hazards 
analysis  indicated  that  metal  shovels  could  initiate  material 
in  the  sumps  at  the  process  water  treatment  facility.  The 
resultant  reaction  could  injure  personnel  present,  at  a  minimum. 
Therefore,  the  use  of  non-metal  shovels  is  strongly  recommended, 

•  At  Hawthorne,  the  process  water  treatment  plant  situation  is 
different  from  that  at  even  other  explosives  plants.  At 
Hawthorne,  mixtures  of  a  wide  variety  of  propellants  and  explo¬ 
sives  must  be  processed  -  not  just  a  single  material.  As  long 
as  water  is  present  in  large  quantities  there  should  not  be  a 
problem.  However,  if  water  is  drained  from  components  and 
materials  are  allowed  to  dry  during  a  shutdown,  dry  mixtures 

of  energetic  materials  of  unknown  characteristics  will  be 
present.  It  is,  therefore,  recommended  that  components  be  kept 
flooded  during  such  shutdowns. 


PREPARATION  BUILDING 

•  It  is  recommended  that  cartridge  cases  to  be  processed  in  the 
preparati on  bui 1  ding  be  tested  to  determine  if  a  flammable 
mixture  of  volatile  vapors  with  air  is  present  in  the  void 
spaces  in  the  case.  Naturally,  this  is  only  relevant  for  cases 
containing  propellant  that  was  manufactured  by  a  solvent  process. 
Analyses  conducted  in  this  study  indicated  that  a  flammable  mix¬ 
ture  may  be  present,  but  there  were  significant  uncertainties 

in  the  analyses  to  determine  this  for  sure.  Therefore,  an  ex¬ 
perimental  solution  is  warranted.  A  gas  sample  can  be  extracted 
from  a  closed  cartridge  case  by  drilling  a  small  hole  into  the 
case,  or  a  flammable  gas  detector  can  be  used  to  monitor  the 
gas  while  cases  are  opened.  In  both  tests  precautions  must  be 
exercised  to  prevent  and  guard  against  an  ignition  of  the  gases 
or  propellant  in  the  case.  If  uncertainty  remains  even  after 
such  testing,  it  is  recommended  that  a  flammable  gas  detector 
be  installed  in  the  vicinity  of  the  case  cutter  and  pull  apart 
machines  to  warn  operators  of  the  presence  of  a  flammable  gas 
during  the  operation  of  Cell  5. 

•  It  is  imperative  that  a  water  cushion  be  present  at  all  times 
for  fuzes  dropped  into  the  "fuze  drop"  tanks  in  Cells  3  and  6. 

It  is  possible  that  the  operators  will  allow  this  tank  to 
become  empty  (no  water)  or  to  become  overfilled  with  fuzes. 
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In  either  case,  a  finite  probability  exists  for  initiation 
of  the  fuzes  by  impact.  Therefore,  it  is  recommended  that  a 
sensor  be  installed  to  warn  the  operators  of  insufficient 
water  at  the  start  of  an  operation  and  of  too  many  fuzes  during 
the  operation.  This  could  be  accomplished  by  sensing  the  weight 
of  the  tank.  Prior  to  operation,  the  weight  must  be  at  least 
that  of  a  water  filled  container  or  the  operation  cannot  begin 
by  interlock.  During  operation,  if  the  weight  exceeds  the  level 
at  which  fuzes  are  no  longer  protected  by  a  significant  layer 
of  water,  a  warning  should  be  actuated.  Alternate  solutions 
to  this  Droblem  should  be  evaluated. 

•  Preparation  Building,  Cell  1,  is  now  earmarked  for  storage  of 
"unsafe"  items  ...  until  enough  of  them  accumulate  to  be  taken  to 
the  disposal  site".  This  is  a  blatantly  unsafe  practice  and  it 

is  recommended  that  it  not  be  done.  Should  an  "unsafe"  or  "suspect" 
round  or  item  be  detected,  its  disposal— or  at  the  very  least, 
its  removal  from  a  busy  operating  building — should  be  immediate, 
and  under  strict  control.  To  do  any  less  than  this  would  be  a 
highly  unsafe  act.  Removal,  after  all,  should  pose  no  major 
hardship.  Based  on  the  combined  assumed  throughput  rates  of 
cell  3,  and  cells  4-5-6,  and  the  1  per  1000  "suspect"  item  inci¬ 
dence  projected,  we're  only  talking  about  3  per  day. 

•  It  is  anticipated  that  the  robot  manipulators  will  require 
frequent  preventive  maintenance  to  minimize  the  possibility 
of  mechanical  or  control  failures  that  can  result  in  impacts 
causing  equipment  damage  and/or  initiation  of  munitions  items 
being  handled. 

•  It  is  recommended  that  partitions  be  constructed  to  better 
isolate  the  different  individual  work  stations  in  the  Preparation 
Building  corridor,  receiving  area,  and  distribution  area.  Cur¬ 
rently,  if  an  incident  occurs  which  causes  a  round  or  item  to 
fire  or  detonate,  personnel  at  other  work  stations  are  in  a 
direct  path  for  serious  injury  by  blast,  fragments  or  an  acci¬ 
dentally  launched  projectile.  Isolating  personnel  to  the  extent 
practical  with  partitions  will  at  least  increase  their  protection 
against  fragments  and  projectiles. 

•  For  the  various  unscrewing  operations  in  the  Preparation  Building 
and  elsewhere,  it  is  suggested  that  consideration  be  given  to 
spraying  the  threaded  areas  with  a  compatible  penetrating  lubri¬ 
cant  before  attempting  to  unscrew  the  parts.  This  could  improve 
the  safety  of  the  operation  by  wetting  any  trace  contaminants  which 
may  be  present,  and  by  minimizing  the  force  required  to  loosen 

the  stuck  threads. 
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ACCUMULATOR  SYSTEM 

•  It  is  recommended  that  the  rubber  boots  inside  the  pinch  valves 
in  the  accumulator  building  be  periodically  inspected  for  wear 
that  could  lead  to  a  major  leak.  The  rubber  boots  or  pinch 
valves  should  be  repaired  or  replaced  if  such  wear  is  observed. 

A  large  leak  in  the  rubber  boot  could  cause  impingement 
initiation  of  small  propellant  grains  being  processed. 

•  Bearing  failure  in  the  smokeless  powder  conveyor  can  result  in  a 
fire  due  to  frictional  heatinq  at  a  stuck  roller  or  due  to  a 
bearing  overheating.  It  is  recommended  that  the  roller  bearings 
in  the  smokeless  powder  conveyor  be  inspected  and  maintained 
frequently.  A  conservative  inspection/maintenance  and  part  replacement 
schedule  should  be  established  based  on  the  manufacturers  relia¬ 
bility  data  for  the  bearings  in  use.  With  regard  to  overheated 
bearings,  periodic  infrared  photographs  during  the  operation  or 
strategically  placed  infrared  sensor  might  be  useful  to  sense  the 
onset  of  the  bearing  failure. 

•  Care  should  be  taken  during  the  setup  of  the  rubber  receiving 
hopper  to  assure  that  it  does  not  push  too  tightly  against  the 
moving  conveyor  belt.  Calculations  indicated  that  a  nominal 
force  (10  lb)  could  result  in  a  significant  temperature  rise 
at  the  interface. 

•  Whenever  a  powder  or  granular  material  is  emptied  from  one 
vessel  or  hopper  into  another  container,  the  possibility 
exists  that  a  significant  voltage  difference  will  develop 
between  the  two  containers  due  to  electrostatic  charging.  If 
the  voltage  difference  is  high  enough,  a  discharge  can  occur 
between  the  containers  or  to  another  object,  for  example  to  an 
operator.  Such  a  discharge  could  ignite  the  material  being 
transferred.  Therefore,  it  is  strongly  recommended  that  posi¬ 
tive  electrical  bonding  be  assured  between  the  weigh  hopper 
and  the  Type  III  or  MKIV  container  being  filled  in  the  accumu¬ 
lator  system,  as  well  as  between  the  various  dust  collector  and 
vacuum  system  hoppers  and  the  Type  III  container  used  during 
system  emptying  operations.  A  reasonable  assurance  of  bonding 
can  be  achieved  by  placing  the  Type  III  or  MKIV  container  onto 
a  conductive  rubber  covered  metal  platform  (or  the  roller  con¬ 
veyor  in  the  case  of  the  filling  operation)  that  is  permanently 
bonded  to  the  equipment  item  being  emptied.  The  platform  must 
be  kept  clean  or  its  effectiveness  will  be  lost.  In  addition, 
a  separate  bonding  strap  should  be  manually  connected  between 
the  hopper  beinq  emptied  and  the  container  being  filled.  This 
redundancy  affords  some  degree  of  assurance  that  bonding  will 
be  achieved  only  as  long  as  the  electrical  contacts  are  clean 
and  secure. 
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•  The  dust  collector  and  vacuum  system  ducts  should  be  inspected 
and  cleaned  frequently  to  avoid  any  significant  buildup  of  a 
propellant  dust  layer  inside  the  ducts.  Periodically  flushing 
out  (e.g.  with  hot  water)  should  be  considered  to  minimize  the 
buildup.  Materials  handled  by  the  dust  collector  and  vacuum 
systems  should  be  checked  to  assure  compatability  at  the  tempera¬ 
tures  to  which  they  will  be  exposed  inside  the  ducts. 

•  Preparation  Building,  Cell  5,  and  the  Accumulator  Building, 
together,  present  a  unique  problem,  viz.,  segregation  and  control 
of  "dissimilar"  propellants.  Propellants  dumped  in  Cell  5,  are 
to  be  conveyed  to  the  Accumulator  Building  for  packaging". . .for 
storage  or  for  sale".  Care  must  be  taken  in  both  locations, 
therefore,  to  prevent  uncontrolled  mixing  of  different  propellant 
types.  Each  propellant  formulation  must  be  separately  and 
individually  packaged  because  mixing  —  although  not  hazardous 
per  se--would  pose  a  serious  problem  or  threat  to  a  buyer,  in 
the  event  of  sale.  Processing  methods  for  reclamation  or  reuse 
of  double-  or  triple-base  propellants  (e.g.,  M26  or  M30)  are 
much  different  than  those  for  single-base  (e.g..  Ml,  M6,  or 
BS-NACO).  To  mix  them  together  would  cause  an  intolerable, 

and  potentially  hazardous,  problem  in  certain  cases.  For 
example,  introduction  of  NG  into  a  process  designed  to  recover 
NC  from  single-base  propellants  would  create  a  real  safety  hazard. 


MECHANICAL  REMOVAL  BUILDING 


The  analyses  of  the  mechanical  removal  building  included  the  punch  press 
operation  (Cell  1),  the  small  band  saw  operation  (Cell  2),  and  the  hole  sawing 
operation  (Cell  3). 

Punch  Press  Operation  (Cell  1) 

The  hazards  analysis  of  the  punch  press  operation  was  based  on  the  assump¬ 
tion  that  long  primer  tubes  will  be  segmented  in  Cell  1.  If  primer  tubes  are 
to  be  processed  in  Cell  1,  the  following  recommendations  are  provided: 

•  It  is  recommended  that  drop  tests  be  carried  out  on  primer  tubes 
in  order  to  accurately  determine  their  response  to  this 
stimulus.  Should  such  tests  show  a  significant  probability 

of  initiation,  it  is  strongly  recommended  that  additional  tests 
be  carried  out  to  determine  the  response  of  primer  tubes  enclosed 
in  a  Type  II  container  to  impact,  and  to  test  various  methods  of 
cushioning  within  the  container  to  prevent  such  initiations. 

•  It  is  strongly  recommended  that  Drimer  tubes  be  instrumented  and 
subjected  to  the  shearing  operation  to  determine  functional 
forces  which  arise  during  the  shearing  operation.  Small  amounts 
of  black  powder  may  be  included  in  these  tests  to  determine 
characteristic  response  data. 
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•  These  tests  should  be  done  prior  to  the  startup  of  the  Cell  1 
operation.  If  initiation  is  likely,  the  extent  of  damage  to 
the  cell  due  to  an  individual  primer  tube  being  ignited  and 
due  to  a  Type  II  container  filled  with  primer  tubes  being 
initiated  should  be  evaluated  based  on  simulation  testing.  It 
is  conceiveable  that  the  consequence  of  an  initiation,  e.g. 
during  shearing,  can  be  tolerated  in  this  case. 

Small  Band  Saw  Operation  (Cell  2) 

•  The  small  and  large  band  saw  operations  are  quite  similar  in 
many  respects.  Therefore,  many  of  the  recommendations  made 
for  the  large  band  saw  apply  here  also  (see  Section  4.4.2) 

•  In  the  small  band  saw  operation,  the  "head"  of  the  item  will 
either  fall  into  a  tray,  or  be  thrown  after  sawing  is  completed. 

In  either  case,  the  initiation  of  a  significant  amount  of 
explosive  in  the  head  (about  one  pound)  is  expected.  Sympathetic 
detonation  of  the  three  depth  charges  in  the  fixture  could  also 
occur,  resulting  in  major  system  damage.  It  is  strongly  recommended 
that  the  fixture  and  carrier  plate  be  redesigned  so  that  the 
"head"  of  the  item  is  secured  and  does  not  fall  freely  after 
sawing. 

Hole  Sawing  Operations  (Cell  3) 

•  It  is  strongly  recommended  that  a  conservative  inspection 
and  replacement  schedule  be  developed  for  the  cutters  to  be 
used  in  Cell  3.  It  is  expected  that  these  cutters  will  gen¬ 
erally  have  a  short  life  span  and  will  require  frequent  re¬ 
placement.  A  dull  or  broken  cutter  can  result  in  initiation 
inside  a  munitions  item  being  processed  in  the  cell. 

•  It  is  strongly  recommended  that  operating  parameters  be 
derived  for  the  hole  sawing  operation,  such  as  was  accomp¬ 
lished  for  band  saws  and  hacksaws  in  reference  4.  It  is 
expected  that  criteria  for  teeth  per  inch,  cutting  force 
and  cutting  speed  must  be  carefully  defined  for  each  item 
to  be  processed  to  minimize  the  probability  of  initiation 
during  cutting. 

•  It  should  be  noted  that  the  most  hazardous  condition  during 
hole  sawing  will  be  cases  where  the  hole  is  not  positioned 
correctly  and  loose  internal  plumbing  is  sawed  into  (by 
analogy  with  the  band  saw  results  presented  in  reference  4). 

In  these  cases,  increased  frictional  heating  occurs  due  to 
cocking  of  the  loose  internal  part,  while  exposure  to  coolant 
is  restricted.  In  addition,  relatively  large  quantities  of 
explosive  could  remain  hidden  behind  the  internal  plumbing 
and  become  ignited. 
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LARGE  CELLS 

The  two  active  operations  in  the  Large  Cell  area  were  analyzed  for  poten¬ 
tial  hazards.  These  were  the  unscrew  machine  (Cell  C),  and  the  large  band  saw 
(Cell  B).  Cell  A  is  presently  empty  and  did  not  require  a  hazards  analysis. 


Unscrew  Machine  (Cell  C) 

•  The  manual  removal  of  the  base  fuze  and  associated  cleaning  of  the 
base  plate  and  fuze  are  considered  to  be  inherently  hazardous 
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to  this  problem  be  evaluated. 


Large  Band  Saw  (Cell  B) 

•  It  is  strongly  recommended  that  an  untreated  nonconductive  plastic 
sheet  not  be  used  to  cover  items  sectioned  at  Cell  B.  Rather, 
the  sectioned  items  should  be  covered  with  a  relatively  high 
conductivity,  low  permittivity  material,  for  example  con¬ 
ductive  plastic,  paper  or  treated  cloth.  Otherwise,  an  electro¬ 
static  discharge  from  the  plastic  sheet  has  a  finite  probability 
to  initiate  the  exposed  explosive. 

•  The  sawing  operation  is  inherently  hazardous.  Strict  manage¬ 
ment  controls  must  be  enforced  to  insure  that  the  proper  force 
and  saw  cutting  speed  are  used  for  the  particular  item  to  be 
cut.  If  a  contaminated  empty  item  is  to  be  sawed,  the  initia¬ 
tion  probability  can  be  significantly  higher  than  for  a  full 
item  (from  reference  4  analysis)  and  the  sawing  conditions, 
must  be  adjusted  to  account  for  this.  While  sawing  contaminated 
empty  items  internal  plumbing  should  be  avoided,  because  this 

is  where  thermal  initiation  is  most  likely. 


ROTARY  FURNACES  IN  THE  DECONTAMINATION  BUILDING 

•  By  far  the  majority  of  problem  areas  that  were  identified  will 
result  in  lost  production  and  not  a  major  hazard. 

a  The  potential  hazard  with  by  far  the  greatest  consequence  is  that 
of  the  truck  driver  hitting  the  nearby  unprotected  propane  tank 
while  movinq  the  scrap  metal  recovery  trailer.  It  is  recommended 
that  strategically  located  posts  similar  to  those  protecting  the 
lightning  poles  be  positioned  around  the  propane  tank.  Proper 
placement  of  such  posts  would  still  allow  easy  access  for  filling 
the  tank.  An  alternate  approach  would  be  to  relocate  the  propane 
tank. 


1 1 T  RESEARCH  INSTITUTE 


TRAY  TYPE  FLASHING  FURNACE  IN  THE  DECONTAMINATION  BUILDING 


•  Strict  controls  must  be  enforced  to  assure  that  inspection 

procedures  are  accompTTshed  with  care  so  that  filled  or  partially 
filled  items  are  not  put  into  the  tray  type  furnace. 

§  It  is  recommended  that  a  deluge  system  be  installed  in  the  bag- 
houses  at  the  Decontamination  Building. 


LARGE  ITEMS  FLASHING  CHAMBER 


•  It  is  strongly  recommended  that  detailed  inspections  be  carried 
out  on  decontaminated  items  processed  in  the  Flashing  Chamber. 

The  items  should  be  disassembled  and  or  sectioned  so  that  bolt 
threads  and  other  tight  areas  can  be  observed  to  assure  that 
contamination  does  not  remain  after  flashing  is  completed.  Since 
"flashing"  is  a  short  duration  high  temperature  exposure  it  is 
quite  likely  that  the  heat  will  not  have  time  to  penetrate  to 

all  of  the  interior  contaminated  regions  of  an  item.  This  type 
of  inspection  procedure  should  be  accomplished  until  a  reasonable 
data  base  has  been  developed  to  assure  that  decontamination  by 
flashing  does  indeed  work  and  is  reliable. 

Itshould  be  noted  that  visual  inspection  of  a  treated  item  will 
not  necessarily  assure  adequacy  of  decontamination.  Cracks, 
threaded  areas,  and  sub-surface  cavities  or  flaws  can  still  house 
hidden  and  undetectable  explosive  material. 

•  Raking  of  the  sand  beds  on  the  mine  cars  should  be  carried  out 
with  care  for  each  flashing  cycle  to  assure  that  very  little 
contamination  remains  in  the  sand  and  that  a  cushion  is  present 
to  prevent  direct  metal  -  metal  contact.  It  is  recommended 
that  non-metal  rakes  be  used  for  this  purpose  to  minimize  the 
possibility  of  impact  initiation  of  contamination  that  remains 
on  the  mine  car. 

•  It  is  recommended  that  the  concrete  pad  outside  the  flashing 
chamber  be  periodically  wetted  down  to  minimize  the  possibility 
of  electrostatic  discharge  from  operators  or  equipment  as  con¬ 
taminated  items  are  handled  in  this  area. 

•  It  is  strongly  recommended  that  remote  purely  electrical  ignitors 
be  used  to  initiate  the  burns  in  the  Flashing  Chamber.  Squibs 
or  other  ignitors  that  contain  explosives  that  are  sensitive 

to  ESD  are  undesirable  because  of  the  potential  for  premature 
initiation.  Use  of  a  powder  train  is  undesireable  due  to  the 
possibility  that  the  operator  could  inadvertantly  light  the 
powder  train  too  close  to  the  items,  or  not  set  up  a  long  enough 
powder  train,  or  become  injured  on  his  way  out  and  not  be  able 
to  escape  in  time. 


1 1 T  RESEARCH  INSTITUTE 


42 


•  It  is  recommended  that  reliable  non-combustible  bracings  be 
designed  for  each  type  of  item  to  be  decontaminated  in  the 
Flashing  Chamber.  "Make-shift"  arrangements  should  not  be  used 
because  of  the  high  potential  for  the  bracing  to  collapse  and 
items  to  fall.  The  smokeless  powder  and/or  contamination  could 
become  ignited  from  the  impact  in  such  an  event. 

•  It  is  recommended  that  operators  at  the  Flashing  Chamber  be 
trained  to  know  what  all  possible  smokeless  powders  to  be  used 
will  look  like.  Any  material  that  does  not  fit  this  pattern 
should  not  be  used  in  any  event.  For  example,  flakes,  chips, 
or  small  pieces,  etc.  could  be  explosive  misrouted  and  actually 
intended  for  processing  in  the  Bulk  Incinerator.  Packing  items 
on  a  flashing  car  with  such  a  material  could  result  in  a  major 
explosion  inside  the  chamber. 

•  It  is  recommended  that  criteria  be  carefully  defined  to  limit 
the  amount  of  propellant  packed  into  items  of  different  types 
and  as  a  function  of  the  ventilation  holes  available.  Too  much 
propellant  could  result  in  an  explosion  if  the  material  is  con¬ 
fined  too  strongly.  These  criteria  should  be  based  on  tests. 

Test  data  may  be  available  to  help  develop  such  criteria.  Dif¬ 
ferent  smokeless  powders  are  likely  to  require  different  criteria. 

•  Strict  management  controls  should  be  enforced  so  that  items  are 
carefully  inspected  to  assure  that  a  total  of  less  than  10  pounds 
of  explosive  is  in  all  the  items  prior  to  flashing.  An  explosion 
involving  an  equivalent  of  more  than  10  pounds  of  TNT  could 
seriously  damage  the  chamber.  This  probably  requires  that  the 

10  pounds  be  in  one  location  rather  than  divided  among  the  items 
to  be  processed,  but  a  total  of  10  pounds  must  be  avoided. 

•  Control  of  the  key  to  actuate  the  ignition  system  from  the  remote 
control  location  should  be  assigned  to  one  specific  individual  in 
the  operating  crew.  No  one  else  should  be  permitted  to  actuate 
the  firing  circuit.  The  key  control  operator  should  be  responsible 
for  final  inspection  of  the  furnace  before  closing  the  doors,  to 
assure  that  all  other  personnel  have  been  evacuated  to  the  remote 
control  location.  It  is  recommended  that  the  accountability, 

for  all  personnel  prior  to  and  during  the  flashing  operation 
be  assigned  by  procedure  to  one  specific  individual. 

•  Under  the  Burning  Ground  requirements  of  AMC  regulation  385-100, 
it  is  required  that  a  24  hour  period  elapse  between  "burns"  on  a 
single  pad.  This  is  to  insure  that  no  "hot-spots"  are  present  on 
the  pad  when  the  next  charge  is  distributed,  to  protect  personnel 
from  premature  ignitions.  Since  the  sand-bed  concept  in  the 
flashing  furnace  is  analagous  to  a  burning  ground  pad,  the  same 
safety  precaution  should  logically  apply.  It  is  suggested  that 
Army  Safety  personnel  review  the  operation  of  this  unit  versus 
the  Burning  Ground  safety  requirements,  and  assure  that  all  appli¬ 
cable  safety  rules  are  operationally  incorporated. 
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DRIVERLESS  TRACTOR  SYSTEM,  OFFLOADING  DOCK,  AND  MAGAZINES 


•  When  the  DLT  is  operated  in  the  manual  mode,  it  is  recommended 
that  the  first  trailer  behind  the  tractor  be  used  as  an  empty 
spacer,  to  protect  the  operator  from  lethal  heat  in  the  event 
the  load  accidentally  ignites. 

•  It  is  recommended  that  driverless  tractor  loads  be  positioned 
with  the  lowest  possible  center  of  mass.  This  will  minimize  the 
chance  for  the  load  falling  off  of  the  carts  in  the  event  of  a 
fast  stop. 

•  The  driverless  tractor  system  that  has  been  installed  at  WADF 
is  rated  as  EE  type  equipment,  rather  than  EX  as  was  required 
in  the  specifications  for  the  DLT.  According  to  AMCR  385-100 
these  two  classifications  for  battery  powered  equipment  can 
be  used  as  follows: 

"Type  EX  equipment  is  approved  for  use  in  Class  1  Group  D 
and  Class  II  Group  G  hazardous  locations."  "Equipment  used 
in  atmospheres  containing  explosives  dusts,  flammable  vapors 
or  flammable  gases,  must  meet  requirements  for  EX  industrial 
trucks. " 

"Type  EE  industrial  trucks  are  satisfactory  for  handling  all 
classes  of  ammunition  and  explosives  packed  in  accordance  with 
Department  of  Transportation  Regulations.  Type  EE  industrial 
trucks  may  be  used  for  handling  partially  loaded  ammunition 
in  corridors  or  ramps  connecting  hazardous  operations,  provided 
the  ramps  and  corridors  are  not  Class  I  or  Class  II  hazardous 
locations  as  defined  in  paragraph  6-3f.  Type  EE  equipment  shall 
not  be  used  in  Class  I  or  Class  II  hazardous  locations." 

Use  of  type  EE  equipment  in  some  buildings  at  WADF  appears  to  be 
borderline  at  best.  The  DLT  should  not  be  used  in  any  areas 
where  explosive  dust  or  flammable  vapors  may  be  present. 

•  The  highest  probability  scenario  in  the  DLT/Offloading  Dock/Magazine 
category  was  that  of  items/containers  falling  out  of  a  railroad 
boxcar  onto  an  operator  when  the  boxcar  door  is  opened.  This  could 
happen  if  the  load  is  not  properly  tied  down  and  shifts  during 
transit.  Great  care  should  be  exercised  by  the  operators  to 
carefully  open  the  boxcar  doors  to  assure  that  the  load  is  not 

in  a  tenuous  position.  To  guard  against  operator  injury  from 
falling  loads  resulting  from  shifted  cargo,  it  is  recommended 
that  a  come-along  should  be  used  to  open  box-car  doors.  The 
operator,  then  is  more  likely  to  be  removed  from  the  door 
opening  area. 
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AIR  BLAST  PROTECTION  FROM  AN  EXPLOSION  IN  A  CELL 

The  adequacy  of  protection  from  airblast  was  evaluated  under  this  project 
and  is  discussed  in  the  Priority  3  Report.  Conclusions  of  that  study  are 
repeated  here: 

•  Pressures  transmitted  to  the  corridor  due  to  the  "piston  action" 
of  a  cell  door  were  determined  to  be  reasonably  low,  but  on  the 
order  of  the  2.3  psig  criteria  for  safety  adequacy. 

$  Pressures  transmitted  to  the  corridor  due  to  leakage  around  the 
edges  of  the  cell  door  were  determined  to  be  quite  high  in  many 
cases,  and  up  to  about  30  psig  in  one  instance.  Therefore,  it  is 
expected  that  unacceptably  high  pressures  are  possible  locally 
close  to  the  cell  doors  in  the  event  of  the  explosion  of  a 
maximum  or  nominal  quantity  of  explosive  detonating  in  several 
of  the  cells. 

•  At  the  mechanical  room  for  the  Bulk  Incinerator  Building,  a  ven¬ 
tilation  duct  provides  a  fairly  direct  route  for  airblast  to  channel 
into  the  mechanical  room.  Calculations  showed  that  the  average 
pressure  in  the  mechanical  room  would  be  quite  low,  but  locally 

at  the  entrance  to  the  duct  the  pressures  could  exceed  the  2.3  psi 
criteria  significantly  if  a  maximum  sized  explosion  occurs  in 
the  process  area  of  the  Bulk  Incinerator  Building.  Because  the 
traffic  flow  pattern  for  personnel  in  the  control  room/mechanical 
room  is  likely  to  have  personnel  in  the  vicinity  of  the  ducts,  a 
severe  injury  could  occur  in  the  event  of  an  explosion.  It  should 
be  noted  that  the  probabilistic  analysis  indicated  that  such  an 
explosion  would  be  quite  unlikely,  and  the  low  probability  should 
be  considered  in  deciding  whether  corrective  action  is  warranted 
in  this  case. 


GENERAL  RECOMMENDATIONS  FOR  THE  WADF  FACILITY  AS  A  WHOLE 


•  Every  operation  on  every  equipment  item  must  be  covered  by  a 
written  procedure,  reviewed  and  approved  by  operating  and 
safety  management  personnel . 

•  A  comprehensive  training  program  should  be  required  for  all 
plant  personnel,  including  information  on  potential  hazards. 

•  All  equipment  operators  should  be  given  appropriate  training 
courses  and  certified  or  licensed  for  operations  in  which  they 
will  be  involved. 

•  All  plant  personnel  should  be  tested  for  electrical  grounding 
of  foot  gear  at  least  once  a  day  with  a  sign-in  sheet. 
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Frequent  cleanup  of  each  plant  area  is  mandatory  to  prevent 
buildup  of  contamination.  Such  cleanups  should  be  scheduled 
as  part  of  the  operating  procedures  for  each  area. 


•  Area  surfaces  should  be  kept  wet  during  maintenance  as  part 
of  the  procedure,  the  equipment  should  be  thoroughly  cleaned/ 
decontaminated  prior  to  any  maintenance  operation. 


•  It  is  recommended  that  a  2  locker  system  be  adopted  for  plant 
personnel.  One  locker  should  be  for  street  clothes  and  a 
second  locker  for  work  clothes.  All  clothing  should  be  changed 
at  the  beginning  and  end  of  the  shift.  Clothing  should  be 
supplied  by  the  plant  -  nothing  taken  home.  A  shower  should 

be  taken  enroute  from  taking  off  work  clothes  to  putting  on 
street  clothes.  This  procedure  will  also  help  avoid  street 
shoes  being  mistakenly  worn  in  the  plant  areas. 

•  An  a~ea  entry  and  hot  work  permit  program  should  be  set  up 

to  assure  that  all  temporary  repairs  and  maintenance  operations 
are  well  thounht.  out  and  accomplished  with  several  levels  of 
safety  a,;d  management  checks. 

•  During  maintenance,  tools  should  be  connected  to  the  workmen 
by  a  cord  wherever  practical  to  help  break  the  fall  of  the 
tool  if  it  is  dropped. 


Strict  cleanliness  must  be  enforced  at  all  times  in  the  plant, 
particularly  when  personnel  leave  contaminated  areas  to  go  to 
lunch  or  at  the  end  of  the  shift.  Nothing  should  be  eaten  in 
the  work  area.  No  food  should  be  allowed  in  the  work  area. 


•  A  medical  surveillance  program  should  be  set  up  to  screen 
personnel  for  specific  jobs  at  hiring  and  to  assure  that  long 
term  health  damage  .is  avoided. 

•  Any  major  system  modifications  made  in  the  future  should  be 
safety  analyzed  upon  completion  of  their  design. 

•  It  is  recommended  that  a  compatibility  data  library  be  set  up 
at  WADF.  Whenever  a  new  material  is  to  be  handled  anywhere  at 
the  site  the  existing  data  should  be  searched  for  potential 
problems.  If  the  existing  data  base  is  insufficient  to  evaluate 
the  new  material,  a  battery  of  compatibility  tests  should  be 
run  on  the  material. 

t  Existing  calculation  methods  for  estimating  the  electrostatic 
discharge  energy  produced  by  a  charaed  dielectric  surface 
generally  overestimate  the  soark  enerqy  in  this  type  of  ESD 
scenario.  The  actual  spark  energy  cannot  be  calculated  using 
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such  methods.  IITRI  has  developed  a  simple  model  for  estimating 
this  spark  energy  from  a  dielectric  surface.  The  model  lacks 
the  required  input  parameter  values  and  validation.  It  is 
suggested  that  tests  be  conducted  to  provide  these  inputs  and 
to  validate  the  model.  This  will  provide  a  much  improved 
quantitative  analysis  method  for  ESD  hazards  associated  with 
dielectric  surfaces. 
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6.  PRIORITIZING  THE  RECOMMENDATIONS 


The  recommendations  presented  in  Section  5  are  all  considered  to  be 
significant  and  should  be  evaluated  carefully  by  ARRCOM  personnel.  To  help 
ARRCOM  personnel  decide  which  recommendations  should  be  pursued  first.  Table 
2  has  been  developed.  The  recommendations  are  listed  in  the  order  that  they 
appeared  in  Section  5  of  this  report.  For  each  recommendation,  the  associated 
probability  per  year  (based  on  mean  values)  and  uncertainty/error  factor  are 
presented.  Based  on  the  probability  value,  the  type  of  recommendations  ( i . e . , 
test  analysis/equipment  modification,  etc.),  the  uncertainty,  and  other 
factors,  a  priority  ranking  from  1  to  10  has  been  assigned.  A  ranking  of  10 
is  given  to  the  highest  priority  recommendations  and  1  is  given  to  the  less 
critical  recommendations.  Recommendations  with  rankings  of  6  to  10  are  con¬ 
sidered  to  be  crucial  and  should  be  implemented  or  at  a  minimum  critically 
evaluated.  Cost  of  implementation  was  not  considered  in  assigning  the  priority 
rankings.  These  rankings  are  in  many  ways  subjective,  but  the  information  in 
Table  2  should  serve  as  a  guide  for  ARRCOM  personnel  to  determine  their  own 
priority  rankings  for  the  recommendations. 

Final  Note 

Appendix  E  to  the  Priority  1  report  is  a  compilation  of  incidents  that 
have  occurred  in  explosive  and  propellant  operations  in  facilities  in  the 
United  States.  The  appendix  consists  of  short  descriptions  of  the  incidents 
grouped  with  regard  to  the  type  of  process  operation  involved.  The  informa¬ 
tion  was  extracted  from  Department  of  Defense  Explosives  Safety  Board  Files 
under  a  prior  contract  conducted  for  ARRADCOM. 

Although  the  process  operations  listed  are  not  for  demilitarization, 
many  similarities  exist.  It  is  suggested  that  the  table  be  scanned  so  that 
the  reader  obtains  a  sense  for  hazardous  events  that  have  occurred  in  the 
past.  In  reviewing  hazards  analyses,  people  generally  are  torn  between  con¬ 
cern  for  safety  and  non-belief  of  scenarios  that  do  not  appear  credible.  It 
must  be  remembered  that  facilities  are  never  designed  to  include  the  obvious 

*•  v  ¥ 
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hazards.  Hazards  that  remain  are  generally  low  probability,  requiring  several 
failures  to  occur.  Yet,  incidents  do  occur.  It  is  the  function  of  hazards 
analysis  to  minimize  the  likelihood  of  such  things  happening. 


TABLE  2.  PRIORITIZING  TH:  RECOMMENDATIONS 
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E  -  Equipment  Modifications 
P  -  Procedure  Modifications 
C  -  Comments 

Priority  of  1  implies  important 
Priority  of  10  implies  critical 
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Frequency  Uncertainty 

Recoronendatlons,  In  Order  Of  Type  Of  Based  On  Mean  (Error  Priority 

System  Presentation  In  Section  5  Recommendation*  Values  (/Year)  Factor)  (1-10)** 
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TABLE  2.  PRIORITIZING  THE  RECOMMENDATIONS  (Cont.) 
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